3 ms·
It seems you are letting any client with a session token update the entire wall. The endpoint simply takes the base64 PNG and sets it as the wall. I was thinki
by pona-a 1y ago
It seems you are letting any client with a session token update the entire wall. The endpoint simply takes the base64 PNG and sets it as the wall.
I was thinking maybe taking a diff, limiting its maximum area, and rate-limiting might at least discourage that.
- kyrylo 1y agoThanks for the heads-up. You’re absolutely right! Rate-limiting could help, but it would make quick strokes difficult, so I decided against it. I’ve already implemented a few measures, but I’d rather not share the details publicly.