No rate limiting on auth or paid API routes in Next.js
Before the expensive call, reject when this user or IP has exceeded a small budget for the window. Store the count in Redis, your database, or a rate-limit service.
Fix for Next.js
Before the expensive call, reject when this user or IP has exceeded a small budget for the window. Store the count in Redis, your database, or a rate-limit service. Memory on one serverless instance is a weak place to store it, because the next instance will not see the count.
Start tight on password attempts and reset emails. Loosen the numbers if real users get locked out. There is no universal correct number. Pick one you can afford if every account hits it.
Return 429 with a short message. Do not explain which passwords were close.
The five-minute check, the other platforms, and the agent prompt are on the full guide. More Next.js fixes are on the Next.js page.