A credential-stuffing attack fires huge volumes of leaked username/password pairs at a login endpoint, hoping a few match real accounts.
tokens += refillRate * dt (capped)
on request: if tokens >= 1 → accept, tokens -= 1
else → reject (429)
- No protection — every request, attack or legitimate, goes straight to the backend at whatever rate it arrives.
- Token bucket — the gateway admits requests only as fast as tokens refill, queuing/rejecting the rest so the backend never sees more than its safe rate.
- When backend load exceeds capacity its health drops, and it starts failing requests for everyone — including legitimate users — which is the denial-of-service side effect.