I'm thinking of rate limiting anonymous requests based on IP, but for users with a valid authentication token, I can't decide if it's better to log and rate limit requests based on their UserId or IP address.
Option 1 : 15 requests per minute per UserId
Option 2 : 30 requests per minute per IP address
Option 3 : Do both
If a malicious person/entity decides to run a bot attack against the APIs, the best option seems to be rate-limiting them based on IP address because they can potentially have a lot of tokens ready for users with different, say, email addresses (assuming each user registers with a unique email address).
However, there is also the possibility that a sophisticated individual can switch IP addresses during the attack but pass the same authentication token and abuse the system with the same UserId.
The third option seems enticing, but for me, it means every API request needs to be written twice to the database (records are horizontally partitioned based on UserId and there is another partitioning scheme based on IP address. Sharding will make it easier to look up and count requests).
Are there any best practices as far as which option (or something else) to pursue when rate limiting authenticated users? I'd like to have a general idea of what to do before I'm deep into writing all the validation logic?