Implementing Secure Rate Limiting and DDoS Mitigation in Node.js

Exposing public API routes or authentication endpoints without rate limiting is an open invitation for credential stuffing attacks and bot scrapers.

Implementing sliding window rate limiters backed by Redis ensures that abusive IP addresses or API tokens are throttled before they can saturate your database connection pool. What rate limit thresholds do you typically enforce on public endpoints?