Hacker News Reader

Really simple cool! One minor thing on the IP rate limiting side.... LOTS of mobile/cell users might end up NAT'ed behind a single IP. Just an FYI.

View on HN

wellllll there's no GREAT answer. Usuallllllyyy this is why some lightweight authentication is a good idea? Some kind of TGT/token scheme, and then rate limit based on that? But does make it all a little less "just works"

That's a good point. How does one rate limit correctly in that case?

I don't think it's possible to correctly rate limit IPs behind NAT, at least with NGINX.

> Note that IP addresses can be shared behind NAT devices, so limiting by IP address should be used judiciously.

https://docs.nginx.com/nginx/admin-guide/security-controls/c...

Rate limiting by data UUID might actually be pretty effective. I should add that to patchbay.pub.

That might be an issue if someone is using it to deliver lets say settings json and multiple users try to request the file.

Reply on news.ycombinator.com