4 ms·
Why not put auth on the endpoint and enforce quotas and rate limiting (an api gateway like kong could handle this for you).
by jb_gericke 3y ago
Why not put auth on the endpoint and enforce quotas and rate limiting (an api gateway like kong could handle this for you).
- pfooti 3y agoEndpoint was invoked in our signup funnel, so there was a bootstrapping problem for quota enforcement, the attackers weren't making a whole signup, just getting to the point where the domain search ran.