Rate limiting is one of those things that doesn't feel urgent—until someone hammers your login endpoint at 3am and you wake up to a flooded database and a locked-out user base.
I added this to my Nuxt base layer after realising I'd shipped several projects with zero protection on auth routes. Not great.
This post walks through the exact setup I now use: Redis-backed, an in-memory fallback when Redis is down, named presets for different sensitivity levels, and a 429 page that shows a live countdown instead of just dying on the user.
The structure
Three pieces, each with one job:
