We use a rate-limiting rule in the existing firewall on the /auth endpoint. Our default is on five failed attempts in a five minute window gets you a one hour ban.
The issue from parent comment is that it needs to be on every access request, not every login request.
How do you fingerprint the requests? IP address?
Two ways, default key is [IP address + User ID] we also have a fallback with a higher limit on [IP address] only when we expect lots of attempts from e.g. a VPN.
The problem I had with IP address fingerprints is that we have a large number of customers all behind one hospital’s single IP address.