2 ms·
I don't know why this is necessary. If a particular IP is hammering your site, it's sufficient to intelligently give HTTP 429 errors to encourage the IP to disc
by OutOfHere 2y ago
I don't know why this is necessary. If a particular IP is hammering your site, it's sufficient to intelligently give HTTP 429 errors to encourage the IP to discipline and temper its requests. It works as well as anything else. If you don't want clients to access data, put it behind a login, not on the open internet.
- Doxin 2y agoThere's a LOT of misbehaving bots out there that will just relentlessly keep hammering an endpoint that returns error codes.
- OutOfHere 2y agoWell, that's because the site too is misbehaving there by always erroring. The site should give the correct response based on a bucket algorithm, and this will cause the bot to ease off. Effectively a rate limit is implemented for mutually satisfactory operations.
- Doxin 2y agoA bot that ignores error codes isn't going to suddenly start behaving itself if your site has a rate limit. It'll simply ignore the rate limiting errors and move on to the next page the second the site does return a non-error response.