Challenge 2 / 3

You turn on Symfony’s login_throttling and it works… but your server CPU still spikes when someone hammers the login page with tons of requests. Why doesn’t login throttling fully save you here?

Because login throttling blocks requests before they hit Symfony, like a firewall would.

Because login throttling only slows down failed logins after the request already reaches your app, so the server still has to do work for each request.

Because login throttling only counts attempts when the password is correct, so attackers can keep sending wrong passwords forever.

Because the limiter resets every time the browser refreshes, so it can’t notice rapid repeated attempts.

Rewatch the video