Challenge 1 / 3

Your app runs on 3 servers behind a load balancer. You turn on login_throttling, but users can still keep guessing passwords way more than the limit. What’s the most likely reason?

login_throttling only blocks requests after a successful login, not failed attempts, so it won’t stop guessing.

The global limiter tracks by username only, so attackers can bypass it by changing IP addresses.

The limiter only works if you also enable lock_factory; without it, throttling is completely disabled.

Each server is using its own non-shared cache, so the limiter counts attempts separately on each server.

Rewatch the video