Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: enable basic rate limiting #480

Merged
merged 7 commits into from
Sep 7, 2022
Merged

feat: enable basic rate limiting #480

merged 7 commits into from
Sep 7, 2022

Conversation

djdembeck
Copy link
Collaborator

@djdembeck djdembeck commented Sep 7, 2022

Recent investigations from #479 performance issues caused me to find there is room for abuse of the public service:

  • Enabling Cloudflare bot fight mode, would overzealously block Plex agents.
  • There were tons of retries of invalid asins that matched the asin regex (and thus proceeded to try the request).
  • A user could send as many requests as they wanted and Cloudlfare may not rate limit or block them.

This PR aims to address these issues by doing the following:

  • Correctly process incoming IPs in a docker container (by trusting upstream proxy).
  • Rate limit ALL routes if there are >100 requests within a minute by default. Allow adjusting this via environment var MAX_REQUESTS.
  • Update the ASIN regex to be stricter, requiring it either stars with B (as a large number of early books use), or it is fully numeric (as all new books are).
  • Enable Redis on the public server.

Eventually rate limit repeated 404 or 400 attempts of different URLs, when this is resolved: fastify/fastify-rate-limit#260

@github-actions
Copy link

github-actions bot commented Sep 7, 2022

Coverage report

St.
Category Percentage Covered / Total
🟢 Statements 100% 805/805
🟢 Branches 100% 258/258
🟢 Functions 100% 157/157
🟢 Lines 100% 759/759

Test suite run success

227 tests passing in 21 suites.

Report generated by 🧪jest coverage report action from 12955e5

@djdembeck djdembeck changed the base branch from main to develop September 7, 2022 23:21
@djdembeck djdembeck added the enhancement New feature or request label Sep 7, 2022
@djdembeck djdembeck marked this pull request as ready for review September 7, 2022 23:30
@djdembeck djdembeck merged commit c6d277b into develop Sep 7, 2022
@djdembeck djdembeck deleted the rate-limiting branch September 7, 2022 23:31
@djdembeck djdembeck mentioned this pull request Sep 8, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant