4 ms·
I've got a feeling it's something that many people have been doing on even mildly complex sites for a long time, but people seem to be trying to SaaS it up rece
by chrisfarms 13y ago
I've got a feeling it's something that many people have been doing on even mildly complex sites for a long time, but people seem to be trying to SaaS it up recently.
protip: Dynamically generating content by URLs is also a nice DOS attack surface if you don't rate limit in some way or try to detect abuse.
- agschwender 13y agoDefinitely, true. The purpose of the signature and allowed hosts functionality is there to help mitigate that risk. Also, since the image service would be run separate from the main application, it shouldn't impact the performance of your site. Likewise, in a real production environment, this would run behind a CDN or Varnish, the DOS would just prevent new images from being generated until it could be addressed.