Imagine a simple API, which offers an endpoint
POST /account/authenticate, which takes a username and password, then returns a JWT on success and an error on failure. In the backend, the endpoint uses some key-derivation function like Argon2 or PBKDF2, with the parameters tuned to be difficult to crack.
Wouldn't such an endpoint allow a very simple resource exhaustion attack? An attacker can cause a high workload on the server without having to do a lot of work themselves. Depending on how the KDF is configured, many parallel requests can consume large amounts of server memory.
Is this actually an issue? And if so, how can this be mitigated? Since this is an API, typical front-end measures like CAPTCHA are not possible.