7 ms·
Do any of such delivery services provide some kind of a DoS prevention for their users or is it always up to the user to implement such prevention mechanism? Fo
by mixedbit 11y ago
Do any of such delivery services provide some kind of a DoS prevention for their users or is it always up to the user to implement such prevention mechanism? For a normal usage the prices are very attractive, but it could only take one rogue script that automatically registers new users on a site (which results in a registration email) for the bill to become large.
- brianwawok 11y agoCan you really DoS an API protected by your password? I would be surprised if they let a bunch of spam out before shutting down your account, they all seem to watch your behavior pretty close.
- mixedbit 11y agoWhat I mean is a script that for example creates a large number of users using a form that is exposed by my web page (not protected by captcha for usability). This would result is my backend issuing large number of API calls to send user registration confirmation emails.
- acomjean 11y agoI know postmark has a credit system, and when you run low they email you. The rates are low enough that it would take a huge volume to cost you. I've never thought of that attack vector before. not allow cross site form filling (using CSRF Cross site request forgery protection) would probably help a lot in that regard. And sleep 2. Your users can wait a couple seconds.
- brianwawok 11y agoAh that makes sense. The last webform I made I tied to a Celery work queue to send my email. Would be 1 flag to limit the send email tasks to "1 / second" or something, which would at least limit damage.