Keying RateLimiter::for('login') on both the lowercase email input and the client IP in Laravel stops credential-stuffing bots rotating through proxies while also keeping a shared office NAT from locking out a whole team.
commit e066f58
e066f58
commit e066f58