SeniorSenior (6–10 yrs)RedisSystem DesignAmazonMicrosoftPayPal
Design a rate-limited login API
Design login with brute-force protection across multiple app servers.
Answers use simple, clear English.
Quick interview answer
Use distributed rate limiting (Redis token bucket per IP + per account), exponential backoff, CAPTCHA after N failures, device fingerprinting, and secure password hashing (Argon2/bcrypt). Separate auth service, audit logs, and lockout policies that avoid account enumeration where possible.
Detailed answer
Use distributed rate limiting (Redis token bucket per IP + per account), exponential backoff, CAPTCHA after N failures, device fingerprinting, and secure password hashing (Argon2/bcrypt). Separate auth service, audit logs, and lockout policies that avoid account enumeration where possible.
#security#rate-limit