Disclosure: these are decisions from Tessera, which I work on. They are all small enough to copy into your own service, which is why they are worth writing up.
Security feature lists are made of nouns: encryption, RBAC, SSO, audit. The things that actually decide whether a system holds up are smaller than that and never make the list. Here are four of ours, with the reasoning, including the case where we made the trade in the direction most people do not.
1. The login rate limit ignores X-Forwarded-For
Rate limiting a login endpoint is table stakes. The question is what you count against.
The natural implementation reads X-Forwarded-For, because your service is behind a load balancer and the real client address is in that header. Almost every tutorial does it this way.
