Loading…
14
Can we talk about rate limits being the real fix or just a band-aid?
Our payments API got hammered last Tuesday around 2am and a single bad client burned through 40k requests in ten minutes. Do you all lean on rate limits as the answer, or is proper OAuth scoping and token expiry the only thing that actually stops this?
1 comments
Log in to join the discussion
Log In1 Comment
mary7768d ago
Rate limits won't stop a bad client that's already authenticated, they just slow it down. OAuth scoping and short token expiry help, but the real fix is per-client quotas tied to the token itself, otherwise you're just capping how fast the fire spreads.
4