Real World Example

A lending or wallet app's login endpoint is attacked constantly (credential stuffing). Several layers work together:

Layer	NestJS tool	Setting
Per-IP rate limit	`ThrottlerGuard`	20 login attempts / 10 min per IP
Per-account lockout	Service logic + Redis counter	Lock 15 min after 5 failures
Same error for unknown email and wrong password	AuthService	"Invalid email or password"
Constant-time compare	`bcrypt.compare`	No timing leaks
Audit log	Interceptor	IP, device, result for every attempt
Secure headers	`helmet`	HSTS, no sniffing

@Controller('auth')
export class AuthController {
  @Public()
  @Throttle({ long: { limit: 20, ttl: 10 * 60_000 } })
  @UseGuards(AccountLockGuard, AuthGuard('local'))
  @HttpCode(200)
  @Post('login')
  login(@CurrentUser() user: User) {
    return this.auth.issueTokens(user);
  }
}

Hardening a Fintech Login API