No Account Lockout / Brute Force Protection

// BAD: login with no rate limiting
export async function POST(req: Request) {
  const { email, password } = await req.json();
  const user = await db.users.findByEmail(email);
  if (!user || !bcrypt.compare(password, user.passwordHash)) {
    return Response.json({ error: 'Invalid credentials' }, { status: 401 });
  }
  return Response.json({ token: generateToken(user) });
}

// GOOD: rate limit login attempts
import { Ratelimit } from '@upstash/ratelimit';
const ratelimit = new Ratelimit({ limiter: Ratelimit.slidingWindow(5, '15m') });
export async function POST(req: Request) {
  const ip = req.headers.get('x-forwarded-for') ?? 'anonymous';
  const { success } = await ratelimit.limit(ip);
  if (!success) return Response.json({ error: 'Too many attempts' }, { status: 429 });
  // ... rest of login logic
}