search

triggerdotdev / jsonhero-web

JSON Hero is an open-source, beautiful JSON explorer for the web that lets you browse, search and navigate your JSON files at speed. 🚀. Built with 💜 by the Trigger.dev team.
https://jsonhero.io
Apache License 2.0
9.01k stars 482 forks source link

Add a ip-based rate limiter #158

Closed ericallam closed 1 year ago

ericallam commented 1 year ago

Currently there is no rate limiter on the jsonhero.io cloud, but we should probably add one to prevent abuse

GeauxWeisbeck4 commented 1 year ago

I was going to volunteer for this one if that's cool. Is there a provider or specific Redis service that I should use? Here's a list of some Redis cache services:

Amazon ElastiCache for Redis Google Cloud Memorystore for Redis Microsoft Azure Cache for Redis IBM Cloud Database for Redis Oracle Cloud Infrastructure Cache Heroku RedisGreen Redis Labs Redis on Flash (RoF) Heroku Redis Scaleway Redis Upstash

ericallam commented 1 year ago

Currently JSONHero is meant to be deployed to Cloudflare on Cloudflare workers, so we have access the Cloudflare KV and Cloudflare DurableObjects, one of which might make sense for this rate-limiter? I'm guessing DurableObjects would be a better fit but I haven't looked into it.

ericallam commented 1 year ago

Also I'm thinking the initial rate limit should be at most 10 per minute per IP, but would be good to control this with an env var

ericallam commented 1 year ago

/bounty $400

daveads commented 1 year ago

/attempt #158

daveads commented 1 year ago

@ericallam taking a look at DurableObjects

ericallam commented 1 year ago

@daveads i think hold off for now. It actually probably doesn't make sense to include the rate limiter in code as self-hosters wouldn't really need it and we can instead use Cloudflare firewall to rate limit JSONHero.io. I'm going to close this issue for now, hoping you didn't spend too much time on this.

GeauxWeisbeck4 commented 1 year ago

@ericallam I don't think this even needs to be hard coded with Cloudflare workers. You can create a rate limiter based on the IP by going onto the dashboard and setting the rule on your firewall. Here is a link:

https://www.cloudflare.com/rate-limiting/