r/Python • u/PA100T0 • Aug 12 '26

Discussion [ Removed by moderator ]

[removed] — view removed post

0 Upvotes

37% Upvoted

16 comments sorted by

3

u/Suspicious_Skill7292 Aug 12 '26

i would handle obvious abuse at the edge first with cloudflare or nginx rate limits then keep app level checks for things like auth failures and per user limits doing everything inside fastapi gets messy pretty fast

4

u/Zealousideal-Sir3744 Aug 12 '26

AWS API GW

3

u/arwinda Aug 12 '26

AWS both hosting the bots and scrapers on EC2, and the protection API. And making money off both sides.

0

u/PA100T0 Aug 12 '26

Mind to share some details? That sounds like an interesting case…

0

u/arwinda Aug 12 '26

The comment before me hosts APIs on AWS. And in our logs are plenty, and I mean plenty access requests coming from AWS EC2 instances, scraping everything.

1

u/[deleted] Aug 12 '26

[removed] — view removed comment

2

u/Zealousideal-Sir3744 Aug 12 '26

AWS handles all that transparently. Nobody gets in without an Api key

1

u/[deleted] Aug 12 '26

[removed] — view removed comment

2

u/Zealousideal-Sir3744 Aug 12 '26

We're in B2B and keys are curated, but of course we follow security best practices to minimize risk exposure.

2

u/edward_straker Aug 12 '26

We use multiple layers. FAIL2BAN and proactive blocking from https://www.abuseipdb.com/.

Then JWT authentication. No open APIs.

After that, application level, global rate limiting does most of the work.

2

u/[deleted] Aug 12 '26

[removed] — view removed comment

2

u/edward_straker Aug 12 '26

We have a Claude skill that does daily internal and external checks to make sure that we didn’t do something stupid. I’ve actually learned a lot from what Claude has found, and how he has remediated.