api/accounts/views.py

@@ -1,16 +1,22 @@
 from typing import Any
 
 from rest_framework import status
-from rest_framework.decorators import api_view, permission_classes
+from rest_framework.decorators import api_view, permission_classes, throttle_classes
 from rest_framework.permissions import AllowAny
 from rest_framework.request import Request
 from rest_framework.response import Response
+from rest_framework.throttling import AnonRateThrottle
 
 from accounts.serializers import LoginSerializer, RegisterSerializer, UserSerializer
 
 
+class AuthRateThrottle(AnonRateThrottle):
+    scope = "auth"
+
+
 @api_view(["POST"])
 @permission_classes([AllowAny])
+@throttle_classes([AuthRateThrottle])
 def register_view(request: Request) -> Response:
     """Register a new user account."""
     serializer = RegisterSerializer(data=request.data)
@@ -24,6 +30,7 @@ def register_view(request: Request) -> Response:
 
 @api_view(["POST"])
 @permission_classes([AllowAny])
+@throttle_classes([AuthRateThrottle])
 def login_view(request: Request) -> Response:
     """Authenticate a user and return JWT tokens."""
     serializer = LoginSerializer(

api/project/settings.py

@@ -91,6 +91,13 @@ REST_FRAMEWORK = {
     "DEFAULT_RENDERER_CLASSES": (
         "rest_framework.renderers.JSONRenderer",
     ),
+    "DEFAULT_THROTTLE_CLASSES": [
+        "rest_framework.throttling.AnonRateThrottle",
+    ],
+    "DEFAULT_THROTTLE_RATES": {
+        "anon": os.environ.get("DJANGO_THROTTLE_ANON_RATE", "10/hour"),
+        "auth": os.environ.get("DJANGO_THROTTLE_AUTH_RATE", "5/minute"),
+    },
 }
 
 SIMPLE_JWT = {