Rate limiting caps how many requests a single client can make within a period of time. It protects endpoints from abuse: without it, an attacker can try thousands of passwords per minute against a login, hammer an API, or drive up your usage bills. When the limit is exceeded, the server rejects further requests until the window resets.
Where it matters most
Login and password-reset routes are the priority, because unlimited attempts turn a weak password into an easy break-in. It also matters on any expensive or costly operation, such as an endpoint that calls a paid API, where volume alone is the attack.
How it is applied
A limiter tracks requests per client, usually keyed on the real IP or the account, and blocks once a threshold in a time window is passed. It should key on the true socket IP, not a header a client can set, and back sensitive routes with a short window and a low count.
What this means for AI-generated code
AI tools generate a login that authenticates correctly but almost never add rate limiting, because the feature works fine without it. That leaves the door open to automated password guessing, one of the easiest attacks to run at scale.