This is the best way to protect your APIs

[dealloc]

Keep in mind that there's different levels of rate limiting. For APIs you should not rate limit based on IP, but rather based on the session or authorization token provided. App-level rate limiting does not protect you against DoS and IP only makes it easy for an malicious attacker to abuse your system.

Additionally this may also have a negative side effect of blocking requests from devices that share the same external IP on the same network.

Other forms of rate limiting and load balancing is best handled at the proxy (i.e. HAProxy, nginx, etc.) and better DNS level (e.g. Cloudflare). This is often handled by whatever provider you have.

[Gamewithstyle]

Lol I did a talk on web app pentesting and included a section on rate limiting. I included an example where (with permission) I took down the very popular jeopardy api that is free and open source. It was back up momentarily, but it really didn’t take much. Very good video, and important information.

[bulelanibotman]

wow! keep them tutorials coming, i love this

[FunkyToe]

Wow, a redis saas with a free tier? I didn't even really know they existed. I'll definitely check our upstash and try it in a project

[Tszyu]

Great information. In larger companies we would usually use an api gateway like apigee, gloo, AWS api gateway or similar to manage access apis as well as bot protection, authentication, rate limiting, a/b testing. It’s interesting to see many channels/creators engineer solutions for nextjs and similar ssr frameworks rather than use dedicated backend apis. I can admit it’s easy for a small project to just use the backend capabilities of the ssr frameworks but I would encourage engineers on the quest for learning to also learn backend technologies as most companies would not yet host a production api as part of a nextjs or similar deployment.

[alexandrepereira]

Good video as usual ! What is your extension to do queries inside VSCode?

[ahmedahmedx]

Hi cody, what font and theme do you use in vscode please ?

[HorstKirkPageKian]

At 6:05 I noticed that the response time increased immensely from 16 ms to 454 ms. Also on later successful requests the response time was in the three digit region. Is this the cost of having a remote redis db instead of a local one, or is this because it's in another region like you mention towards the end of your video? Is there anything one can do about it to lower the response time again?

[kolya]

using IP alone is might not be a good idea. maybe also consider device ID, tokens etc.? I've also noticed this method in binance years ago they limit based on IP so no one on your network can spam

[wcatly]

Can you make a tutorial for making secure api routes between server client

[ayushkathariya]

whic theme are you using in this video

[AndreSchmidt-mouu]

Your videos are very good! Can you make a video for upstash Kafka?

[rwz]

Nice and concise. One comment though for "paid" services using ips alone is not a good idea, adding the users api token prevents users with access to a lot of ips to rotate through and change the source-ips.

[zlackbiro]

You can create a middleware and without redis ask is that ip is used 10 seconds ago. You can keep users ip in the memory or in the database.

[ameer]

how to determine the right amount of rate limiting ? if it's for site like unsplash

[petermckeever]

Do you know if it's possible to blacklist with upstash? Looking to target some suspected scraping crawlers

[justhaithem]

great video...
in google they use great technique of rate limiting. "exponential backoff"
first the user starts with 2 s waiting time
then if he requeated the api again the waiting time will increase to 4
then 8 ..16 ... 32...
did you recognized the pattren?
it's 2^n
now your traffic will be more organized so if someone insisted 10 times he's gonna wait for 20 minutes
if he invoked 30 times more he will wait until the end of the world💀.
if you wanna implement this make sure to tell the user in front-end otherwise it's just bad UX

[biltriq]

Coady great video u talked about bots briefly on a previous video.and how we should protect env file..please make a video on that

[razdingz]

what vscode theme is that ? pretty cool

[Netryon]

As somebody in NSA said this isn't a request and it takes some time until they let to get epic items for experiments. It is probably a daily credits use, so if you take more than a book from a bookshelf today nobody will let you search unless you are paying customer. Ninetails stash is safe if you are alone in the jump town. I think headers should be as they was onload and only content manipulated would be it's body, well unless you do a redirect. With big services they do all the restrictions, but you have to create it if you are an original rum shaker.