Rate limiting on signup is important to prevent an attacker to create lots of spam accounts in the database and eventually to exhaust database resources or disrupt the flow.

Rate limiting on password reset is important to prevent an attacker from flooding a victim’s mailbox.

So here is my question: How do I prevent this? I didn’t find any mention of this scenario on the devise github repo. I think the implementation part would be okay for me: put the code in the corresponding action in the devise controller. My question is mainly about discussion which approach to take.

A strategy I can think of is saving the amount of signup request for each IP in redis, with maybe an expiration time of 30 minutes or whatever. And if that amount is higher than, let’s say, 10, fail with a notice. Similarly, Redis could be used to save and expire email addresses to which password reset emails have been sent and allow only one every 30 minutes.

But one could also use postgres for that, or maybe even something in-memory. Is there any more or less standard approach for this? How do you handle this?