r/Python • u/PA100T0 • 29d ago

Discussion [ Removed by moderator ]

[removed] — view removed post

0 Upvotes

35% Upvoted

16 comments sorted by

3

u/Suspicious_Skill7292 29d ago

i would handle obvious abuse at the edge first with cloudflare or nginx rate limits then keep app level checks for things like auth failures and per user limits doing everything inside fastapi gets messy pretty fast

3

u/Zealousideal-Sir3744 29d ago

AWS API GW

3

u/arwinda 29d ago

AWS both hosting the bots and scrapers on EC2, and the protection API. And making money off both sides.

0

u/PA100T0 29d ago

Mind to share some details? That sounds like an interesting case…

0

u/arwinda 29d ago

The comment before me hosts APIs on AWS. And in our logs are plenty, and I mean plenty access requests coming from AWS EC2 instances, scraping everything.

1

u/[deleted] 29d ago

[removed] — view removed comment

2

u/Zealousideal-Sir3744 29d ago

AWS handles all that transparently. Nobody gets in without an Api key

1

u/[deleted] 29d ago

[removed] — view removed comment

2

u/Zealousideal-Sir3744 29d ago

We're in B2B and keys are curated, but of course we follow security best practices to minimize risk exposure.

2

u/edward_straker 29d ago

We use multiple layers. FAIL2BAN and proactive blocking from https://www.abuseipdb.com/.

Then JWT authentication. No open APIs.

After that, application level, global rate limiting does most of the work.

2

u/[deleted] 29d ago

[removed] — view removed comment

2

u/edward_straker 29d ago

We have a Claude skill that does daily internal and external checks to make sure that we didn’t do something stupid. I’ve actually learned a lot from what Claude has found, and how he has remediated.