timeout if user makes too many inserts?

[srvmux]

is there a way to timeout an authenticated user and flag them if they make too many insert or update requests in a short period of time? how would we implement rate limiting?

[quicksnap]

I was also just thinking about this. There's a few use cases for me:

• Sign-up invitation codes. I don't want a user to try and brute force codes.
• Preventing storage abuse. Users will be uploading frequent small files to storage, but they should adhere to a sensible rate according to my business logic.

I could imaging a userland solution: When inserts happen, you use a postgres trigger to write up a tally somewhere. Similarly, have a before-trigger to check the tally. But, seems overkill to track this stuff in the DB.

@kiwicopple mentioned this in a HN thread 9 months ago: https://news.ycombinator.com/item?id=24073571

[srvmux]

@quicksnap thanks a lot for this answer I'm planning to slef-host supabase once they figure out storage, so something like this rate limiting with kong would probably work

[quicksnap]

Hopefully someone at Supabase chimes in here.. I am hoping to avoid self-hosting, but having rate-limiting as a feature would be good.

[inian]

Hi @quicksnap, from Supabase here. We are internally moving Kong to be backed up a database instead of using a declarative configuration. This will make it much easier to update configuration (including rate limiting) per route. The Kong rate limiting plugin supports IP based rate limiting which hopefully solves this issue.

There will be sane defaults for rate limits applied when fully move to the Kong back up a database and we can probably make it configurable via the dashboard over time too.

[quicksnap]

Niiiiceeee