Rate Limiting & Throttling for Abuse Prevention

Traditional rate limiting relies on tracking the client's source IP address (req.ip). In modern production environments, this single-dimensional approach suffers from two fatal flaws:

1. Residential Proxy Botnets (The Credential Stuffing Threat):

Attackers lease networks of millions of compromised residential IoT devices and mobile proxy nodes (e.g., BrightData, Oxylabs). When launching automated credential stuffing attacks against /login:

• The botnet rotates IP addresses on every single request.
• Each unique IP sends only 1 request every 10 minutes, easily slipping beneath simple IP-based thresholds (e.g., 100 req/min).

2. Corporate, University, and Carrier-Grade NAT (CGNAT):

Thousands of legitimate employees at a corporate campus or students at a university share a single outbound public NAT IP address. An overly aggressive IP rate limiter will block hundreds of innocent users because one employee ran an automated test script.