Description
Ensure the project has WAF custom rules with the Rate Limit action on endpoints that can be abused, such as login, sign-up, password reset, search, and API routes. Each rule should limit how many requests a single client can make in a set time window.
Rationale
Without rate limits, attackers can send unlimited requests to guess passwords, create fake accounts, scrape data, or run up usage costs. Rate limiting slows down these attacks by blocking or challenging clients that send too many requests in a short time, while normal users are not affected.
Impact
Slows down brute-force and scraping attacks
Helps control usage costs from abusive traffic
Limits that are too low can block real users
Default Value
By default, no rate limiting rules are configured. WAF Rate Limiting is available on all plans (1 rate limit rule on Hobby). The Fixed Window strategy is available on all plans and Token Bucket on Enterprise. Rate limiting has usage-based pricing.
Pre-Requisites
Project Administrator, team Member, or Security role
A list of endpoints to protect and their normal traffic levels
Test Plan
Sign in to Vercel at https://vercel.com.
Select your team from the team switcher.
Select the project from the dashboard.
Open Firewall in the sidebar.
Open Rules and verify that the Project rules section has at least one enabled rule that uses the Rate Limit action on the sensitive endpoints.
If none exist, follow the implementation steps.
Implementation Steps
Sign in to Vercel at https://vercel.com.
Select your team from the team switcher.
Select the project from the dashboard.
Open Firewall in the sidebar.
Select Add New at the top right, choose Rate Limit, and enter a name, for example Login rate limit.
Add an If condition that matches the endpoint (for example, Request Path, Equals, /api/login).
Set the Then action to Rate Limit. If this is your first rate limit rule, review the Rate Limiting Pricing dialog and select Continue.
Select Fixed Window, then set the Time Window (default 60s) and Request Limit (default 100 requests), and choose the key to count by, such as IP address.
Leave the action as Default (429), or choose Log to monitor first, then select Save Rule.
Select Review Changes, then select Publish, to apply the changes.
Backout Plan
Sign in to Vercel at https://vercel.com.
Select your team from the team switcher.
Select the project from the dashboard.
Open Firewall in the sidebar.
Open Rules, find the rate limit rule in the Project rules section, and disable or delete it.
Select Review Changes, then select Publish, to apply the changes.
Reference