A credential-stuffing attack fires huge volumes of leaked username/password pairs at a login endpoint, hoping a few match real accounts. This 2D view flattens the pipeline into three lanes so you can read the bucket's fill level and every request's fate directly, without a camera to orbit.
tokens += refillRate * dt (capped)
on request: if tokens >= 1 → accept, tokens -= 1
else → reject (429)
- No protection — every request, attack or legitimate, goes straight to the backend at whatever rate it arrives.
- Token bucket — the gateway admits requests only as fast as tokens refill, rejecting the rest so the backend never sees more than its safe rate.
- When backend load exceeds capacity its health drops, and it starts failing requests for everyone — including legitimate users — which is the denial-of-service side effect.