If we ever going to make our API public we need to be able to protect it. I suggest implementing rate limiting on two levels:
- Rate limit by client IP address. Allow a certain amount of requests per a certain time period. For example, 50 requests per minute.
- Rate limit globally as primitive protection against DDOS.
This is in addition to #9.
If we ever going to make our API public we need to be able to protect it. I suggest implementing rate limiting on two levels:
This is in addition to #9.