Auth0 Suspicious IP Throttling Attack Protection Does Not Trigger

Auth0 Suspicious IP Throttling Attack protection does not trigger when requests contain an invalid grant or response type. Because Auth0 rejects these requests based on schema definitions before checking credentials, the throttling mechanism does not activate. The tenant logs display multiple errors for specific IPs, such as the following:

"description": "Missing required parameter: response_type"

• Auth0
• Suspicious IP Throttling Attack Protection

Auth0 rejects requests with an invalid grant or response type based on schema definitions before checking the username and password. Because Auth0 ascertains no information about the correctness of the credentials, Suspicious IP Throttling protections do not activate. Additionally, Attack protection only applies to the Authentication API and does not monitor calls to the Multi-Factor Authentication (MFA) API or Management API.

Why does Suspicious IP Throttling fail to trigger for invalid requests?

Suspicious IP Throttling protections provide a layer of defense against credential stuffing attacks alongside Bot Detection. The feature prevents a single IP from executing an unbounded number of username and password checks when the checks continue to fail.

When a request includes an invalid grant or response type, Auth0 never checks the username and password. Auth0 rejects the request based on schema definitions for that endpoint. Consequently, Auth0 gathers no information regarding credential correctness, and Suspicious IP Throttling protections do not activate.

NOTE: Attack protection only applies to the Authentication API. Auth0 does not check calls to the MFA API or Management API for suspicious IPs.