4 ms·

My hosting provider just decided to turn my server off for no apparent reason. I have no idea why yet, waiting on an answer from support. The timing for this is

My hosting provider just decided to turn my server off for no apparent reason. I have no idea why yet, waiting on an answer from support. The timing for this is the absolute worst possible... Needless to say I'm going to be looking for alternatives again. If anyone knows of good hosting companies with unmetered 10 Gbps let me know.

jeroenhd 5y ago
FYI, it seems to be back up now! I did notice one potential flaw in the way your API/website works, though, which is that raw access to the uploaded files is enabled regardless of content type. This allows people to use your website to host scripts and other malicious files that they can reuse to execute XSS attacks against other websites. This is mostly a problem for the other website (which would lack proper security headers) but it could lead to Google blacklisting your website for "hosting malware". Some phone scammers leverage websites like yours that try to provide a simple, cheap service to host their fake virus warnings and such. I'd personally recommend against allowing text content to be directly accessible with a single GET request from another source. You've set up some protections against this (rate limiting mode) but that could be circumvented by pointing a browser at the file viewer and placing something heavy on the F5 key. I'd personally also check the origin/referrer headers for files that aren't images or video and block their direct inclusion in some way.
- Fornax96 5y ago
  Views are unique per IP address (/48 subnet for IPv6) so continuously refreshing the page wouldn't work. I had problems like this in the past, but rate limiting mode seems to have solved it. I have had little abuse complaints in that regard the last few years. But thanks for the suggestion, I'll look into it.

4 ms·

My hosting provider just decided to turn my server off for no apparent reason. I have no idea why yet, waiting on an answer from support. The timing for this is

by Fornax96 5y ago

jeroenhd 5y ago
FYI, it seems to be back up now! I did notice one potential flaw in the way your API/website works, though, which is that raw access to the uploaded files is enabled regardless of content type. This allows people to use your website to host scripts and other malicious files that they can reuse to execute XSS attacks against other websites. This is mostly a problem for the other website (which would lack proper security headers) but it could lead to Google blacklisting your website for "hosting malware". Some phone scammers leverage websites like yours that try to provide a simple, cheap service to host their fake virus warnings and such. I'd personally recommend against allowing text content to be directly accessible with a single GET request from another source. You've set up some protections against this (rate limiting mode) but that could be circumvented by pointing a browser at the file viewer and placing something heavy on the F5 key. I'd personally also check the origin/referrer headers for files that aren't images or video and block their direct inclusion in some way.
- Fornax96 5y ago
  Views are unique per IP address (/48 subnet for IPv6) so continuously refreshing the page wouldn't work. I had problems like this in the past, but rate limiting mode seems to have solved it. I have had little abuse complaints in that regard the last few years. But thanks for the suggestion, I'll look into it.