r/Python • u/PA100T0 • 20d ago

Discussion [ Removed by moderator ]

[removed] — view removed post

0 Upvotes

35% Upvoted

16 comments sorted by

3

u/Suspicious_Skill7292 20d ago

i would handle obvious abuse at the edge first with cloudflare or nginx rate limits then keep app level checks for things like auth failures and per user limits doing everything inside fastapi gets messy pretty fast

5

u/Zealousideal-Sir3744 20d ago

AWS API GW

3

u/arwinda 20d ago

AWS both hosting the bots and scrapers on EC2, and the protection API. And making money off both sides.

0

u/PA100T0 20d ago

Mind to share some details? That sounds like an interesting case…

0

u/arwinda 20d ago

The comment before me hosts APIs on AWS. And in our logs are plenty, and I mean plenty access requests coming from AWS EC2 instances, scraping everything.

1

u/[deleted] 20d ago

[removed] — view removed comment

2

u/Zealousideal-Sir3744 20d ago

AWS handles all that transparently. Nobody gets in without an Api key

1

u/[deleted] 20d ago

[removed] — view removed comment

2

u/Zealousideal-Sir3744 20d ago

We're in B2B and keys are curated, but of course we follow security best practices to minimize risk exposure.

2

u/edward_straker 20d ago

We use multiple layers. FAIL2BAN and proactive blocking from https://www.abuseipdb.com/.

Then JWT authentication. No open APIs.

After that, application level, global rate limiting does most of the work.

2

u/[deleted] 20d ago

[removed] — view removed comment

2

u/edward_straker 20d ago

We have a Claude skill that does daily internal and external checks to make sure that we didn’t do something stupid. I’ve actually learned a lot from what Claude has found, and how he has remediated.