უსაფრთხოება5 წუთის საკითხავი
Rate limits, and the abuse they are actually for
Limits are not about capacity. They are about the small number of clients that will otherwise consume everything, and they are easier to add before you need them.
ეს სტატია ჯერ ინგლისურადაა. ვთარგმნით.
A rate limit is usually explained as protection against load, which undersells it. Ordinary traffic does not need limiting. The limit exists for the single client that will make ten thousand requests a minute, whether through malice or a loop somebody wrote by accident.
Where to put them
- Login endpoints, which is where credential stuffing arrives.
- Anything that sends an email or a message, because that costs money and reputation.
- Expensive queries - search, reports, anything that scans.
- Registration, unless you enjoy moderating accounts nobody created on purpose.
Fail politely
Return a clear status and a retry hint rather than dropping the connection. A well-behaved client will back off; a badly behaved one was going to be blocked anyway, and now you have a log line that says why.