7 ms·
I agree. Our public APIs are also massively queried. The number of queries is out of proportion to the legitimate traffic. Rate-Limiting does not work, because
by davidspiess 3y ago
I agree. Our public APIs are also massively queried. The number of queries is out of proportion to the legitimate traffic. Rate-Limiting does not work, because of the volume of different ips they send against you in parallel. Our servers are not designed for such peaks. What other choice do we have but to block them.
- batch12 3y agoIn addition to blocking/throttling, I have my services provide bad data to the abusing clients.
- didntcheck 3y agoAs in "valid" but false data? Please don't. If you really don't want to indicate rate limiting explicitly, then perhaps return an invalid body, or reset the connection or similar. False positives detecting humans as bots are very common, and even rate limits are often set well within human interaction limits. E.g. more than once I've triggered 429s by opening several e-commerce product pages in new tabs for me to ctrl+tab through and filter down. I also tripped a LinkedIn anti-automation system since I was looking through quite a lot of profiles on my first day to add people - luckily they handled this well, with a clear message explaining what was going on and support reaching out to me proactively (and lifting the restriction after a few hours)
- batch12 3y agoIf I block and throttle you already then yes, I reserve the right to break your downstream service by feeding you bad data.
- afandian 3y agoDid you consider API keys? Via email? That’s at least a natural throttle.
- davidspiess 3y agoIt's a public price API. There is no authentication required to list prices.
- zb3 3y agoCould you explain why that API is meant to be public and what benefits it brings to human users? What kind of data does it return?