How to get rate limiting right
This is cheap to get right at the start and expensive to retrofit. The short answer to rate limiting is that it is mostly a sequence of small decisions, not one big one.
The cheapest security work is the boring kind done on a schedule. If it only works because one person remembers to do something, it does not work yet.
The reason this keeps coming up
Unlimited endpoints get abused eventually. There is a version of this that is over-engineered, and it is worth avoiding. If it only works because one person remembers to do something, it does not work yet.
The steps
- Establish what you have today before changing anything
- Limit by account and by address
- Return a clear response instead of failing silently
- Write down the decision so the next person does not re-litigate it
Return a clear response instead of failing silently. It is worth being explicit about, because assumptions differ quietly. Anything you cannot measure here, you are deciding by taste, which is fine as long as everyone knows it.
Making it stick
How to tell if yours is fine
Security is a maintenance habit rather than a purchase, which is why it drifts. Three things worth confirming about rate limiting before you move on:
- Someone can say what the current setup is without going to look
- Unlimited endpoints get abused eventually — and you know whether that is true here
- There is a way to tell whether the last change to this helped
Most of the value here comes from doing the first two things, not all of them.