iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To stop SMS one-time-password (OTP) abuse in a NestJS customer-support backend, budget both code issuance and verification, enforce limits per account as well as per source, bind each code to its request and intended action, and record security events without logging secrets. SMS is not phishing-resistant, so offer stronger authentication where the application supports it and treat number-change signals as risk inputs.
How should SMS OTP abuse budgets work?
Use separate policies for sending codes and checking them. A send limit helps prevent repeated texts to one person and automated spraying across many destinations. A verification limit prevents guessing. Track failed verification per account so an attacker cannot bypass the control by rotating IP addresses, and add source-level limits to contain bursts.
NestJS’s authentication guide demonstrates global IP tracking and, for routes that name an account, a combined normalized email-and-IP tracker. Its tutorial uses five attempts per 15 minutes for sign-in and three per 15 minutes for selected email-sending endpoints. Those are examples for the guide’s routes, not recommended SMS issuance or verification limits. Set application budgets based on account risk, legitimate user behavior, SMS-provider cost, and the support process for locked-out users.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →- Issuance: Limit requests per account or destination and include relevant source signals. Record delivery outcomes separately from requests.
- Verification: Limit failed attempts per account, with additional source-level controls. Count failures across resends rather than allowing a fresh code to erase the account’s failed-attempt history.
- Outcome: Define what happens when a budget is exhausted, such as a temporary block or a recovery route, and emit an event for that decision.
OWASP ASVS calls for brute-force rate limiting on code-based out-of-band authentication. OWASP’s MFA guidance calls for per-account limits when SMS is the only factor. ASVS 5.0 marks its SMS/PSTN requirements for Levels 2 and 3, and phone/SMS is unavailable at Level 3; apply requirements according to the assurance level and context that govern your service.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How do you configure rate limits in NestJS?
NestJS rate limiting is provided by a separate package. The official rate-limiting guide documents controls including limit, ttl in milliseconds, and blockDuration, along with custom tracker and key-generation functions, headers, and custom storage.
- Choose tracker dimensions that fit the abuse case: source IP for broad bursts, account or destination for targeted abuse, and account-plus-source where a combined signal is useful.
- Use shared storage when the backend runs multiple instances; otherwise, each instance may enforce its own local budget rather than one service-wide budget.
- Configure trusted proxy behavior before relying on client IP. Misconfigured proxy trust can cause the application to interpret the wrong address as the source.
- Keep issuance and verification limits distinct so their counters, windows, blocks, and audit outcomes match the action being protected.
Do not copy the authentication guide’s tutorial thresholds as universal limits. Tune policies against the actual routes, expected customer behavior, and operational consequences of both abuse and false lockouts.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How should the OTP lifecycle be protected?
Bind the code to one request and action
Associate the issued code with the account, the specific out-of-band request, and the intended action. Verification must not allow a code issued for one request to authorize a different or later request. Consume a valid code once, and reject it after its validity window.
Free tools Windows power users keep installed
One-click scans. No signup required.
NIST SP 800-63B-4 states that out-of-band authentication must complete within 10 minutes, a valid secret is accepted only once, and generating a new secret must not reset the failed-authentication count. Apply those requirements in the standard’s relevant authenticator and assurance context; do not assume every SMS use has identical regulatory applicability. For TOTP, set the accepted time window with expected clock drift, network delay, and user entry time in mind.
Rank #3
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Make counters and redemption atomic
Protect OTP collection with authenticated channels, as NIST requires. Update attempt counters and code state atomically: concurrent requests must not exceed the budget or redeem the same code twice. NestJS’s authentication guidance identifies concurrent use of one code and bursts of failed codes as important race conditions to account for.
Keep OTP values out of application logs, and avoid responses that disclose whether an account exists. The verification response should not give an attacker an account-enumeration signal while still providing a usable path for legitimate customers.
Rank #4
- POWERFUL SECURITY KEY: The YubiKey 5C Nano is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C Nano secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: The YubiKey 5C Nano is designed to stay plugged into your device via USB-C. Simply tap it to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What should the audit trail record?
Store searchable security events rather than relying only on transient application logs. NestJS’s authentication guide describes security-relevant event streams and recommends storing events where the security team can search them. The authorization guide describes denial context such as policy, ability, reason, user, arguments, and handler.
A practical event set includes:
- Code requested and delivery outcome.
- Verification success or failure.
- Budget exhausted, temporary block, or lockout decision.
- Recovery or alternative-factor use.
- Relevant authorization denials.
For each event, consider a timestamp, event type, opaque account identifier where possible, request or action correlation identifier, tracker category, result, and the policy or limit decision. These are implementation recommendations, not a schema prescribed by NestJS. Record only the authorization-denial fields needed for investigation; serializing all arguments can expose sensitive data. Never include OTP values or provider secrets. Restrict access to the audit store and set retention appropriate to your organization.
Best Value
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
When is SMS the wrong factor, and what should replace it?
SMS/PSTN delivery has security and availability risks. NIST says out-of-band authentication is not phishing-resistant and advises making alternative authenticator types available. For PSTN delivery, it also advises considering device-swap, SIM-change, and number-porting signals before sending a code. OWASP warns against SMS in high-risk or personally identifiable information (PII)-handling contexts and recommends planning a move toward TOTP, push, or WebAuthn/FIDO2 when SMS is the only option.
OWASP ASVS 5.0 says SMS/PSTN OTP should be offered only after validating the phone number, alongside stronger alternatives and user-facing information about the security risks. The appropriate choice depends on the application’s risk and recovery needs; an alternative factor does not remove the need to protect any SMS route that remains available.
Quick Recap
| Factor | Relevant strengths and limits | Backend considerations |
|---|---|---|
| SMS/PSTN OTP | Uses a phone number the user can access, but is not phishing-resistant and can be affected by number or device changes. | Validate the number, apply issuance and per-account verification budgets, bind codes to requests, and consider device-swap, SIM-change, and porting signals. |
| TOTP or push | OWASP and NIST identify these as alternatives to SMS; the cited guidance does not establish a universal ranking among them. | Plan enrollment and recovery, and apply controls appropriate to the selected authenticator. |
| WebAuthn/FIDO2 | A stronger alternative to consider in a migration plan; implementation and user access requirements differ from SMS. | Requires compatible WebAuthn/FIDO2 authentication in the application. A physical security key is relevant only when that support exists, and does not replace SMS abuse budgets or audit logging. |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems
