How to implement IP based rate-limit in Credentials provider (or any other)

[Baterka]

I have trouble with implementing IP rate limitation for Credentials provider (https://next-auth.js.org/providers/credentials). It is applicable to any other provider also.

I cannot find a way to retrieve the Request object in authorize method to implement such a system.

My app is getting a ton of false attempts even I am using ReCAPTCHA so I want to mitigate this with an IP-based rate limiter.

[balazsorban44]

I think you should implement this at a higher level, not in next-auth. Your entire application could be hosted somewhere that blocks/rates certain IPs from bombarding it.

Limiting in the authorize callback seems like it wouldn't really solve the issue, and your application could still suffer in terms of performance.

[balazsorban44]

@Baterka this has been added in 3.23.0! 🎉

authorize(credentials, req /*<-- new*/)

[IshfaqAhmedProg]

Can you elaborate on that a little bit more? or point to some form of documentation?