Rate limit password reset requests?

dan · 2 Sept 2020, 15:15

Hi, is it possible to rate limit password reset requests?

dan · 2 Sept 2020, 15:16

This is not currently handled by FusionAuth. You would have to use another application firewall of some sort that offers rate limiting. Here's an example for nginx: https://docs.nginx.com/nginx/admin-guide/security-controls/controlling-access-proxied-http/

We have discussed adding this feature, but due to the other options available it has not yet been prioritized. Feel free to open a feature request on GitHub.