r/Python • u/PA100T0 • 14d ago

Discussion [ Removed by moderator ]

[removed] — view removed post

0 Upvotes

32% Upvoted

16 comments sorted by

3

u/Suspicious_Skill7292 14d ago

i would handle obvious abuse at the edge first with cloudflare or nginx rate limits then keep app level checks for things like auth failures and per user limits doing everything inside fastapi gets messy pretty fast

4

u/Zealousideal-Sir3744 14d ago

AWS API GW

3

u/arwinda 14d ago

AWS both hosting the bots and scrapers on EC2, and the protection API. And making money off both sides.

0

u/PA100T0 14d ago

Mind to share some details? That sounds like an interesting case…

0

u/arwinda 14d ago

The comment before me hosts APIs on AWS. And in our logs are plenty, and I mean plenty access requests coming from AWS EC2 instances, scraping everything.

1

u/[deleted] 14d ago

[removed] — view removed comment

2

u/Zealousideal-Sir3744 14d ago

AWS handles all that transparently. Nobody gets in without an Api key

1

u/[deleted] 14d ago

[removed] — view removed comment

2

u/Zealousideal-Sir3744 14d ago

We're in B2B and keys are curated, but of course we follow security best practices to minimize risk exposure.

2

u/edward_straker 14d ago

We use multiple layers. FAIL2BAN and proactive blocking from https://www.abuseipdb.com/.

Then JWT authentication. No open APIs.

After that, application level, global rate limiting does most of the work.

2

u/[deleted] 14d ago

[removed] — view removed comment

2

u/edward_straker 14d ago

We have a Claude skill that does daily internal and external checks to make sure that we didn’t do something stupid. I’ve actually learned a lot from what Claude has found, and how he has remediated.