Capability

IP throttling

What it does: Slows bursts of failed logins from the same address.

CIC

In short

IP throttling slows down a burst of failed login attempts from one IP address. Attackers lose the speed they need to try many passwords. Customers on other addresses can keep signing in.12

Book a callHow Auth0 does it ↓
5
attack types it helps against

What it is, and the attacks it stops

Many attacks on a login page come from a single address, because it is the cheapest way to send a large number of requests, so the faster an address can send them, the more passwords it can try.

IP throttling limits that speed. Suspicious IP Throttling counts failed login attempts from an address, and Auth0 can throttle the traffic when the count is unusually high.1

That helps against attacks such as:

1

Brute-force password guessing

An attacker tries many passwords against one account as fast as the requests can be sent.

2

Credential stuffing from one source

A single address tries a long list of leaked email and password pairs on your login page.

3

Password spraying

One address tries a few common passwords against many accounts, so that no single account shows many failures.

4

Mass sign-up from one address

A script creates many fake accounts from the same address in a short time.

5

Account enumeration

One address tries many email addresses to learn which ones have an account with you.

Before and after rollout

Without
With
WithoutOne address can try passwords as fast as it can send requests.
WithAuth0 can throttle an address that makes an unusually high number of attempts.1
WithoutAn attack from one address runs until someone notices it and blocks the address by hand.
WithThrottling applies automatically at login and sign-up.1
WithoutA trusted office or partner network gets the same limits as the rest of the internet.
WithYou can allowlist trusted IP addresses.1

How Auth0 does it

Auth0 Suspicious IP Throttling watches the attempts that arrive from each IP address and slows an address that behaves unusually.1

1

Requests arrive from an address

Customers and attackers send login and sign-up requests to your Auth0 tenant.1

2

Auth0 watches the number of attempts

Auth0 tracks how many attempts come from each IP address.1

3

Throttling applies when the pattern is unusual

When an address makes an unusually high number of attempts, Auth0 can throttle the traffic from it.1

4

Settings and the allowlist decide the exceptions

You can configure the protection and list trusted IP addresses that should not be throttled.12

CIC
Who it protectsYour app's users
Suspicious IP ThrottlingAuth0 Attack Protection includes throttling for addresses that make an unusually high number of login or sign-up attempts.12
IP allowlistYou can allowlist trusted IP addresses so that they are not throttled.1
Brute-force protectionAuth0 also offers protection against repeated failed attempts on a single account.3

How Zelto implements it

Auth0 provides the limits - Zelto checks with you where your customers connect from, such as shared offices, mobile networks and partner proxies, so that throttling slows attackers without catching those customers. We plan the rollout in stages to minimize risk/impact, and we give support a clear answer for a customer who gets throttled.

Typical rollout

  1. Map where sign-ins come from

    We review your logs for the addresses, networks and partners that send sign-in and sign-up traffic.

  2. Build the allowlist

    We list the trusted addresses, such as your own offices and partner systems, and agree who on your side approves changes to that list.

  3. Review the protection settings

    We check that the throttling and brute-force protections are enabled and that the responses match how your customers sign in.

  4. Prepare support

    We write a short script for support, so that a throttled customer hears what happened and what to do next.

  5. Watch and adjust

    We review throttled traffic on a schedule, and we update the allowlist and settings when your customers or the attacks change.

Pitfalls we plan for

Many customers share one address, such as an office or a mobile network.

−Treat every address as a single customer. One noisy user causes throttling for everyone behind it.

+Check where customers connect from, allowlist the networks you trust and watch throttled traffic after the rollout.

Attackers rotate their addresses.

−Rely on IP throttling alone. Each new address starts with a fresh allowance.

+Combine it with bot detection and breached password detection, so that attackers cannot avoid every control by changing an address.

Your own tests or a partner integration send many requests.

−Run load tests or integrations against production without telling anyone, and get throttled.

+Use a test environment, or add the source to the allowlist for the duration of the test, with a named owner who reviews the entry.

A customer is throttled and calls support.

−Support has no explanation, so it asks the customer to try again until it works.

+Support has a script that explains what happened and checks the sign-in logs before suggesting anything.

Want bursts of failed logins to stop at the door?

We review where sign-in traffic to your customer accounts comes from today. Then we tell you what to change first.

Book a call30 minutes, no slides. We look at your customer login flows today.

Sources

Official Okta and Auth0 documentation and primary legal sources.

  1. 1Suspicious IP throttlingAuth0 Docs
  2. 2Attack protectionAuth0 Docs
  3. 3Brute-force protectionAuth0 Docs