We should add rate-limiting in some places, especially for endpoints where we have request limits. At the moment these are the following endpoints:
/auth/login: SFU CAS/translink: realtime endpoint is limited to 1000 requests a day
There are a few places we can add rate-limiting.
Nginx
This can limit certain IPs before it reaches the web server, but the University and its residences shares IPs, so this needs to handled carefully.
Web Server
There are some libraries we can use, but we need to see whether adding this is compatible with our current setup. We use multiple uvicorn workers for concurrency, so in-memory solutions will not work (I tried and it kinda sucked). One thing we could try is adding sqlite, to manage projects that need durability, but don't require a long-lived database.
We should add rate-limiting in some places, especially for endpoints where we have request limits. At the moment these are the following endpoints:
/auth/login: SFU CAS/translink: realtime endpoint is limited to 1000 requests a dayThere are a few places we can add rate-limiting.
Nginx
This can limit certain IPs before it reaches the web server, but the University and its residences shares IPs, so this needs to handled carefully.
Web Server
There are some libraries we can use, but we need to see whether adding this is compatible with our current setup. We use multiple uvicorn workers for concurrency, so in-memory solutions will not work (I tried and it kinda sucked). One thing we could try is adding sqlite, to manage projects that need durability, but don't require a long-lived database.