Can I use rate-limiting with HTTP basic authentication in Apache?

HTTP basic authentication is done by sending an additional header in the each and every request the client makes, i.e. for each and every resource.

Authorization: Basic <credentials>

If you do not provide this header in a request, you will be prompted to provide credentials.

There is thus no single login page which you can protect by any kind of rate limiting or firewall rules. Rate limiting all pages also is not an option. Should you rate limit each IP address to only one request per second, valid users can only fetch one resource per second. Loading a web page, two style sheets, and four images, would thus take at least seven seconds.