Controlling usage.
WHY IT MATTERS
Without limits, one client can consume all capacity, deliberately or by defect.
WHAT TO LIMIT
Requests per client, over a period Authentication attempts, more strictly Expensive operations specifically Upload volume
WHAT TO IDENTIFY CLIENTS BY
An authenticated identity, where available An address, otherwise
WHAT TO BE CAREFUL WITH
Addresses shared by many users, which are common.
WHAT THAT MEANS
Limiting by address alone can affect many legitimate users.
WHAT TO RETURN WHEN LIMITED
A clear status code, and an indication of when to retry.
WHAT TO IMPLEMENT ON AUTHENTICATION
Progressive delay, or lockout after repeated failures.
WHY
It defeats credential guessing.
WHAT ELSE TO PROTECT AGAINST
Automated registration Content submission at volume Expensive searches repeated
WHAT TO MONITOR
Requests per client, and outliers.
WHAT TO ALERT ON
Sudden changes in pattern.
WHAT TO RECORD
Blocked requests, for investigation.
WHAT TO CONSIDER
Protection upstream, at the network edge, for volumetric attacks.
