Skip to content

Glossary: Web App Security and Authentication

Rate limiting

Also written: retry-after

Capping requests per client per time window. kc-shop allows 5 logins a minute per IP, and the sixth gets 429 with a retry-after header giving the seconds to wait.

Where the book teaches it

Related terms

HTTP status codesBrute force