I am busy developing an API for a mobile application, currently one of the endpoints require that the users username and password be POST'ed to it. What I am worried about is someone discovering that API endpoint and brute forcing username/password combinations.

Should I be rate limiting my API? If so, do I need to worry about this now or only down the line if this type of attack actually takes place?

3 Answers 3


Rate Limiting your API endpoint is a good start. However it can be easly bypassed by using proxies or tor sockets for example. What I'd suggest you is to implement a mechanism that validates the request. HMAC https://en.wikipedia.org/wiki/HMAC is a common cryptography authentication protocol that uses shared secret aswell as hashing algorithm. It obviously has some downfalls. Shared secret can be found in a process of reverse engineering your mobile application, thus you should also do proper code obfuscation. It provides extra layers of security and increases attack difficulity and cost.


Yes, you need to make a limit of accesses by the users to avoid brute force. To this you can implement something that checks attempts by a specific user login or specific IP, like Fail2ban do, and then you block access to this user account or IP. To identify if a user is trying to brute force your API you can analyse the time between the attempts, if they are too fast and on a large scale. Another approach is to check if the same user account is trying to login from different IPs in a short period of time.


If possible, you may implement a challenge instead of basically pushing the password over API. For example, the well-known (and still in use in IMAP) CRAM-MD5 may be used.

Using this kind of mechanism, a brute force attack may only lead to a one-time access to the API but not to the leak of user password.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .