Hacker News Reader

Thanks 8), rate limiting is just the most basic of nginx configs to like, 10 requests / second / ip

Really simple cool! One minor thing on the IP rate limiting side.... LOTS of mobile/cell users might end up NAT'ed behind a single IP. Just an FYI.

That's a good point. How does one rate limit correctly in that case?

I don't think it's possible to correctly rate limit IPs behind NAT, at least with NGINX.

> Note that IP addresses can be shared behind NAT devices, so limiting by IP address should be used judiciously.

https://docs.nginx.com/nginx/admin-guide/security-controls/c...

Rate limiting by data UUID might actually be pretty effective. I should add that to patchbay.pub.

That might be an issue if someone is using it to deliver lets say settings json and multiple users try to request the file.

wellllll there's no GREAT answer. Usuallllllyyy this is why some lightweight authentication is a good idea? Some kind of TGT/token scheme, and then rate limit based on that? But does make it all a little less "just works"

Oh nice, that sounds simple enough.

Reply on news.ycombinator.com