# How does Auth0 filter spam Authorization token requests for SPAs?

**URL:** <https://community.auth0.com/t/how-does-auth0-filter-spam-authorization-token-requests-for-spas/79810>\
**Category:** Get Help\
**Tags:** spam, auth0\
**Created:** [March 14, 2022, 7:34am UTC](https://community.auth0.com/t/how-does-auth0-filter-spam-authorization-token-requests-for-spas/79810 "2022-03-14T07:34:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![gitscr](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/gitscr/32/35840_2.png) [@gitscr](https://community.auth0.com/u/gitscr)\
**Post date:** [March 14, 2022, 7:34am UTC](https://community.auth0.com/t/how-does-auth0-filter-spam-authorization-token-requests-for-spas/79810/1 "2022-03-14T07:34:16Z")

</div>

I was planning on using Auth0 for my React project (SPA), and according to the OAuth flow of SPA’s, client\_secret is not issued. Anyone can see the request that my application makes to Auth0 for the authorization token, and can use the request to spam my account. How does Auth0 defend my account against it, otherwise, I will have several login attempts count that will drive up my quota.

Thanks

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [March 17, 2022, 8:02pm UTC](https://community.auth0.com/t/how-does-auth0-filter-spam-authorization-token-requests-for-spas/79810/3 "2022-03-17T20:02:34Z")

</div>

Hi @gitscr,

Welcome to the Auth0 Community! 👋

There is no quota for failed auth transactions. Quotas are based on active users and M2M tokens, which only occur when an auth transaction is successful.

We also offer a suite of attack protection features, some are enabled by default.

> **[Attack Protection](https://auth0.com/docs/secure/attack-protection)**
>
> Describes how Auth0 detects attacks to stop malicious attempts to access your application, alert you and your users of suspicious activity, and block further login attempts.

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [April 22, 2022, 12:02am UTC](https://community.auth0.com/t/how-does-auth0-filter-spam-authorization-token-requests-for-spas/79810/4 "2022-04-22T00:02:07Z")

</div>