What is Rate Limiting & HTTP 429?
Server caps on request volume per client or key, answered with status 429 plus a Retry-After hint when exceeded. Limits protect login, signup, and AI endpoints from abuse and runaway costs.
Example
Login and AI-generation routes answer over-budget clients with status 429 and a Retry-After hint. Frontends back off and queue instead of retrying in a tight loop that deepens the overload.
What people get wrong
Returning success statuses with error bodies for throttled calls. Standard 429 responses let clients, proxies, and edge caches cooperate; bespoke signals force every integrator to guess.
Related terms
Brute-Force Protection
Defenses that slow or block repeated credential guessing: attempt counters, progressive delays, CAPTCHAs, and account lockouts. Effective setups throttle quietly while alerting on distributed patterns.
Webhook Timestamp Tolerance
The maximum acceptable age of a signed webhook before rejection, typically measured in minutes. Tolerance windows block replay attacks while forgiving normal delivery delays and clock skew.
Server Endpoint (+server.js)
The privileged layer for webhooks, secrets, and server-only logic. Anything touching keys, tokens, or private APIs lives here — never in components.
Cross-Site Request Forgery (CSRF)
An attack that tricks a logged-in browser into submitting unwanted state-changing requests to a trusted site. SameSite cookies, anti-CSRF tokens, and origin checks break the forgery chain.
SQL Injection
An attack that smuggles database commands through unsanitized input into application queries. Parameterized statements and least-privilege database roles keep hostile input as data, never executable code.
CSP Directives
The individual rules inside a Content Security Policy, such as script-src, object-src, and frame-ancestors. Each directive narrows one resource class, so auditing means reviewing directives one by one.