article
Login throttle let the caller pick its own name
A hardening commit keyed my rate limiter on an unchecked auth cookie read before any session validation, so a caller who changes the cookie lands in a fresh full bucket every time and the tightest login limits are the easiest to skip.
Read more 4m read