Context: The API that I need to rate-limit is request OTP. A user needs to request it to be able to log in. He can use his phone or email.

By that stage, I don't have the user id or JWT token yet. That's why I first decided to limit the API by a user's IP address.

An example of set up:

  windowMs: 10 * 60 * 1000,
  max: 5,
  message: "Too many requests, please try again later in 10 minutes",
  keyGenerator: (request, response) => {
    return requestIp.getClientIp(request);
  },
});

However, what I don't like in this approach is that a user can change the IP by proxy or so and avoid the limitation. I could set the limiting by for example phone/email that a user sends in the request and the IP, but email/phone also could be easily changed.

My questions:

1. What you can advise in the case that I described above? I mean, maybe there is a way to limit a user before we have his userId or token
2. What is better practice in the rate-limiting? I mean, maybe instead of limiting users separately the better option is to make a limit on the app itself, or another way