4 ms·
What I mean is a script that for example creates a large number of users using a form that is exposed by my web page (not protected by captcha for usability). T
by mixedbit 11y ago
What I mean is a script that for example creates a large number of users using a form that is exposed by my web page (not protected by captcha for usability). This would result is my backend issuing large number of API calls to send user registration confirmation emails.
- acomjean 11y agoI know postmark has a credit system, and when you run low they email you. The rates are low enough that it would take a huge volume to cost you. I've never thought of that attack vector before. not allow cross site form filling (using CSRF Cross site request forgery protection) would probably help a lot in that regard. And sleep 2. Your users can wait a couple seconds.
- brianwawok 11y agoAh that makes sense. The last webform I made I tied to a Celery work queue to send my email. Would be 1 flag to limit the send email tasks to "1 / second" or something, which would at least limit damage.