4 ms·

Failed to verify the token, as in the user did not have valid authorization to download the file. Something like this would really help cutting down on unwante

Failed to verify the token, as in the user did not have valid authorization to download the file. Something like this would really help cutting down on unwanted bot requests as each valid request could be traced back to a user and abusive users could be banned. But if the "failed" requests still cause a charge on your account, this wouldn't really work as intended. Just trying to think of reliable ways to defend against bot downloading causing massive charges, but also without letting them take down the entire site by triggering something like a billing cap. Hostile world out there...

vlovich123 4y ago
If you gave the user an invalid token (as in R2 can reject it because the token isn't valid), we certainly wouldn't bill (after all, that would be a trivial way someone could launch billing attacks on your account). Now if you gave them a token that validates from our end, then I'm not sure how we'd solve that. I think what you're thinking of is maybe some kind of external IAM integration where you could add an additional authentication layer to whitelabel R2 (but then you're back to the problem where you'd be running a worker to validate the account-level logic and paying for that request). I think the solution is bot fight protection services from Cloudflare. There's a bunch in there also to allow well-behaved bots to have access and lets you control what those look like.