Engineering / ENG-1703
identity-service: limit sign-in attempts per address
Description
The WAF limits per address at the edge (OPS-42). identity-service keeps its own limit too, for the attempts that get through.
Acceptance criteria
- Attempts per IP address on the sign-in endpoints are limited (20 a minute); over the limit we answer 429 with
Retry-After. - The limit lives in config per region.
Comments (2)
Jonas Berg · 10 Sep 2026, 07:00 UTC
Out with this morning's release.
Picking this up as my first ticket. Sliding window on the existing cache.