Add Rate Limiting on the Login

Use Case

Adding rate limiting to the login flow will significantly harden the security by preventing automated scripts from spamming the authentication API. Add Max 5 tries every 10 minutes. Failure login doubles the wait time (1s, 2s, 4s, 8s...). Account Lockdown need email confirmation after many times. Send an email that is 'someone tried to login to your account' for security purposes.