Web Api security hack : Setting up rate limiters

[oluwatobi2001]

Web Api security hack : Setting up rate limiters

[Theodore-Kelechukwu-Onyejiaku]

Hi @oluwatobi2001 ,

This looks good! Could you please provide an outline. Thank you.

[oluwatobi2001]

Good day editor, I wrote the outline within the issue .Thanks

…

On Mon, 1 Apr 2024, 17:30 Theodore Kelechukwu Onyejiaku, < ***@***.***> wrote: Hi @oluwatobi2001 <https://github.com/oluwatobi2001> , This looks good! Could you please provide an outline. Thank you. — Reply to this email directly, view it on GitHub <#1316 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AGW7FFOH3F2IJOECQBMMDHTY3GDTJAVCNFSM6AAAAABFRVFLT6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMZQGEYDQNRWG4> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[oluwatobi2001]

I. Introduction to Web API Security A. Importance of securing Web APIs B. Overview of common security threats II. Understanding Rate Limiting A. Definition and purpose B. Benefits of implementing rate limiters III. Setting Up Rate Limiters A. Choosing the appropriate rate limiting strategy B. Selecting the right tools and technologies C. Configuring rate limits for different endpoints D. Handling rate limit exceeded scenarios IV. Best Practices for Rate Limiting A. Implementing sliding window algorithms B. Setting reasonable rate limits based on API usage patterns C. Considering strategies for handling burst requests D. Monitoring and adjusting rate limits over time V. Advanced Techniques for Rate Limiting A. Implementing token buckets and leaky bucket algorithms B. Combining rate limiting with other security measures like authentication and authorization C. Exploring cloud-based solutions for scalable rate limiting VI. Testing and Monitoring A. Strategies for testing rate limiting implementation B. Monitoring tools and metrics to track rate limiting performance C. Handling and analyzing rate limit-related incidents VII. Conclusion A. Recap of the importance of rate limiting in Web API security B. Final considerations and next steps for securing Web APIs

…

On Mon, 1 Apr 2024, 17:50 oluwatobi joshua, ***@***.***> wrote: Good day editor, I wrote the outline within the issue .Thanks On Mon, 1 Apr 2024, 17:30 Theodore Kelechukwu Onyejiaku, < ***@***.***> wrote: > Hi @oluwatobi2001 <https://github.com/oluwatobi2001> , > > This looks good! Could you please provide an outline. Thank you. > > — > Reply to this email directly, view it on GitHub > <#1316 (comment)>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AGW7FFOH3F2IJOECQBMMDHTY3GDTJAVCNFSM6AAAAABFRVFLT6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMZQGEYDQNRWG4> > . > You are receiving this because you were mentioned.Message ID: > ***@***.***> >

[Theodore-Kelechukwu-Onyejiaku]

Hi @oluwatobi2001 ,

Thanks for the outline. Please are you going to include codes and a github repo we can use to test the technical aspects of this article?

Please let me know, thank you!

[oluwatobi2001]

Yes we will.

…

On Tue, 2 Apr 2024, 16:22 Theodore Kelechukwu Onyejiaku, < ***@***.***> wrote: Hi @oluwatobi2001 <https://github.com/oluwatobi2001> , Thanks for the outline. Please are you going to include codes and a github repo we can use to test the technical aspects of this article? Please let me know, thank you! — Reply to this email directly, view it on GitHub <#1316 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AGW7FFKYWYH75MYWB6TTMA3Y3LEMLAVCNFSM6AAAAABFRVFLT6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMZSGM2TGMZQGA> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[Theodore-Kelechukwu-Onyejiaku]

Hi @oluwatobi2001 ,

It is great to know you will be adding Strapi codes and sharing your github repo with us. Please go ahead. Thank you.

[oluwatobi2001]

Thank you. What's the time limit?

…

On Tue, 2 Apr 2024, 19:03 Theodore Kelechukwu Onyejiaku, < ***@***.***> wrote: Assigned #1316 <#1316> to @oluwatobi2001 <https://github.com/oluwatobi2001>. — Reply to this email directly, view it on GitHub <#1316 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AGW7FFJQZ3T3IKWF5MWYLTDY3LXFNAVCNFSM6AAAAABFRVFLT6VHI2DSMVQWIX3LMV45UABCJFZXG5LFIV3GK3TUJZXXI2LGNFRWC5DJN5XDWMJSGMZTAMBTGQ4DCMY> . You are receiving this because you were assigned.Message ID: ***@***.***>

[oluwatobi2001]

https://hackmd.io/@tobilyn77/ByLYUNbxR here is a link to the draft. i await your review. Thanks @Theodore-Kelechukwu-Onyejiaku

[Theodore-Kelechukwu-Onyejiaku]

Hi @oluwatobi2001 ,

Thank you for sharing your article idea. I understand that this article is about rate limiting. It would be great if your code example and GitHub code demonstrate rate limiting in Strapi.

Kindly let me know if you plan on incorporating this. Thanks.

[oluwatobi2001]

I can incoporate it into the existing code. Thanks

…

On Tue, 9 Apr 2024, 19:16 Theodore Kelechukwu Onyejiaku, < ***@***.***> wrote: Hi @oluwatobi2001 <https://github.com/oluwatobi2001> , Thank you for sharing your article idea. I understand that this article is about rate limiting. It would be great if your code example and GitHub code demonstrate rate limiting in Strapi. Kindly let me know if you plan on incorporating this. Thanks. — Reply to this email directly, view it on GitHub <#1316 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AGW7FFK65KRKIJYRHUZZNKTY4QV7LAVCNFSM6AAAAABFRVFLT6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDANBVHAYTSMBVGI> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[Theodore-Kelechukwu-Onyejiaku]

Hi @oluwatobi2001,

I would appreciate it if you could. Thank you!

[oluwatobi2001]

Hi @Theodore-Kelechukwu-Onyejiaku , i have updated the hackmd documents with the relevant code examples and the github repo. I await your feedback. Thank you

[Theodore-Kelechukwu-Onyejiaku]

Thank you @oluwatobi2001! I will definitely check it out.

[oluwatobi2001]

Hi Sir. Please how many days does it take to get a article reviewed? And can i apply for other ones while waiting for the feedback?

…

On Mon, 15 Apr 2024, 00:04 Theodore Kelechukwu Onyejiaku, < ***@***.***> wrote: Thank you @oluwatobi2001 <https://github.com/oluwatobi2001>! I will definitely check it out. — Reply to this email directly, view it on GitHub <#1316 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AGW7FFKK6XYRXNWBXSDHCCLY5MDRBAVCNFSM6AAAAABFRVFLT6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDANJUGIYTGNJZGQ> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[oluwatobi2001]

Good day sir, Any feedback yet?

…

On Wed, 17 Apr 2024, 19:10 oluwatobi joshua, ***@***.***> wrote: Hi Sir. Please how many days does it take to get a article reviewed? And can i apply for other ones while waiting for the feedback? On Mon, 15 Apr 2024, 00:04 Theodore Kelechukwu Onyejiaku, < ***@***.***> wrote: > Thank you @oluwatobi2001 <https://github.com/oluwatobi2001>! I will > definitely check it out. > > — > Reply to this email directly, view it on GitHub > <#1316 (comment)>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AGW7FFKK6XYRXNWBXSDHCCLY5MDRBAVCNFSM6AAAAABFRVFLT6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDANJUGIYTGNJZGQ> > . > You are receiving this because you were mentioned.Message ID: > ***@***.***> >

[oluwatobi2001]

@Theodore-Kelechukwu-Onyejiaku please can i get a feedback on the article? https://hackmd.io/@tobilyn77/ByLYUNbxR

[Theodore-Kelechukwu-Onyejiaku]

Hi @oluwatobi2001 ,

Your article is in the review backlog. I will let you know if we need anything from you.

Cheers.

[Theodore-Kelechukwu-Onyejiaku]

Hi @oluwatobi2001 ,

Thanks for your contribution! This is supposed to be an intermediate article, so I have some suggestions to make it better. Could you please provide more information about rate limiting by doing the following:

• Real life use cases of rate limiting
• How Popular Social Media sites like Twitter and co add rate limiting.
• How does Rate Limiting works.
• For the Project Demo, It would be great if you precisely provide a step-by-step guide. This should be a real-world project scenario that involves Rate Limiting. You could build it also add a frontend technology or use Postman. The goal is to make this a rich content.

Please let me know what you think.

[oluwatobi2001]

GOOD DAY SIR. i USED POSTMAN AND I EVEN ATTACHED IMAGES THAT INDICATED A LIVE DEMO DONE

…

On Fri, May 10, 2024 at 4:23 PM Theodore Kelechukwu Onyejiaku < ***@***.***> wrote: Hi @oluwatobi2001 <https://github.com/oluwatobi2001> , Thanks for your contribution! This is supposed to be an intermediate article, so I have some suggestions to make it better. Could you please provide more information about rate limiting by doing the following: - Real life use cases of rate limiting - How Popular Social Media sites like Twitter and co add rate limiting. - How does Rate Limiting works. - For the Project Demo, It would be great if you precisely provide a step-by-step guide. This should be a real-world project scenario that involves Rate Limiting. You could build it also add a frontend technology or use Postman. The goal is to make this a rich content. Please let me know what you think. — Reply to this email directly, view it on GitHub <#1316 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AGW7FFMGWQQOCABJICXNQWDZBTQ73AVCNFSM6AAAAABFRVFLT6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCMBUHAYDAMRZGY> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[oluwatobi2001]

I WOULD INCLUDE THE SUGGESTIONS MADE IN THE DRAFT AND GET BACK TO YOU AS SOON AS POSSIBLE. THANK YOU On Fri, May 10, 2024 at 4:34 PM oluwatobi joshua ***@***.***> wrote:

…

GOOD DAY SIR. i USED POSTMAN AND I EVEN ATTACHED IMAGES THAT INDICATED A LIVE DEMO DONE On Fri, May 10, 2024 at 4:23 PM Theodore Kelechukwu Onyejiaku < ***@***.***> wrote: > Hi @oluwatobi2001 <https://github.com/oluwatobi2001> , > > Thanks for your contribution! This is supposed to be an intermediate > article, so I have some suggestions to make it better. Could you please > provide more information about rate limiting by doing the following: > > - Real life use cases of rate limiting > - How Popular Social Media sites like Twitter and co add rate > limiting. > - How does Rate Limiting works. > - For the Project Demo, It would be great if you precisely provide a > step-by-step guide. This should be a real-world project scenario that > involves Rate Limiting. You could build it also add a frontend technology > or use Postman. The goal is to make this a rich content. > > Please let me know what you think. > > — > Reply to this email directly, view it on GitHub > <#1316 (comment)>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AGW7FFMGWQQOCABJICXNQWDZBTQ73AVCNFSM6AAAAABFRVFLT6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCMBUHAYDAMRZGY> > . > You are receiving this because you were mentioned.Message ID: > ***@***.***> >

[oluwatobi2001]

Good day Sir. i have added the suggestions made by you. I await your feedback Sir.

…

On Tue, 2 Apr 2024, 11:47 oluwatobi joshua, ***@***.***> wrote: I. Introduction to Web API Security A. Importance of securing Web APIs B. Overview of common security threats II. Understanding Rate Limiting A. Definition and purpose B. Benefits of implementing rate limiters III. Setting Up Rate Limiters A. Choosing the appropriate rate limiting strategy B. Selecting the right tools and technologies C. Configuring rate limits for different endpoints D. Handling rate limit exceeded scenarios IV. Best Practices for Rate Limiting A. Implementing sliding window algorithms B. Setting reasonable rate limits based on API usage patterns C. Considering strategies for handling burst requests D. Monitoring and adjusting rate limits over time V. Advanced Techniques for Rate Limiting A. Implementing token buckets and leaky bucket algorithms B. Combining rate limiting with other security measures like authentication and authorization C. Exploring cloud-based solutions for scalable rate limiting VI. Testing and Monitoring A. Strategies for testing rate limiting implementation B. Monitoring tools and metrics to track rate limiting performance C. Handling and analyzing rate limit-related incidents VII. Conclusion A. Recap of the importance of rate limiting in Web API security B. Final considerations and next steps for securing Web APIs On Mon, 1 Apr 2024, 17:50 oluwatobi joshua, ***@***.***> wrote: > Good day editor, I wrote the outline within the issue > .Thanks > > On Mon, 1 Apr 2024, 17:30 Theodore Kelechukwu Onyejiaku, < > ***@***.***> wrote: > >> Hi @oluwatobi2001 <https://github.com/oluwatobi2001> , >> >> This looks good! Could you please provide an outline. Thank you. >> >> — >> Reply to this email directly, view it on GitHub >> <#1316 (comment)>, >> or unsubscribe >> <https://github.com/notifications/unsubscribe-auth/AGW7FFOH3F2IJOECQBMMDHTY3GDTJAVCNFSM6AAAAABFRVFLT6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMZQGEYDQNRWG4> >> . >> You are receiving this because you were mentioned.Message ID: >> ***@***.***> >> >

[Theodore-Kelechukwu-Onyejiaku]

Hi @oluwatobi2001,

Your time and effort is very well appreciated. I have left a comment on your draft.

I could not find this heading in your draft.

• How Popular Social Media sites like Twitter and co add rate limiting.

[oluwatobi2001]

I feel both real life use cases of rate limiting and how popular sites use rate limiting are quite similar. I might have to replace the section header on where i discussed Twitter's adoption of rate limiting and its usage. Thank you

…

On Mon, 13 May 2024, 11:02 Theodore Kelechukwu Onyejiaku, < ***@***.***> wrote: Hi @oluwatobi2001 <https://github.com/oluwatobi2001>, Your time and effort is very well appreciated. I have left a comment on your draft. I could not find this heading in your draft. - How Popular Social Media sites like Twitter and co add rate limiting. — Reply to this email directly, view it on GitHub <#1316 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AGW7FFNRXEPI4ULHWC25HU3ZCCFUXAVCNFSM6AAAAABFRVFLT6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCMBXGE2TOMZWGA> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[oluwatobi2001]

Thank you Sir. The comment has been addressed

…

On Mon, 13 May 2024, 14:13 oluwatobi joshua, ***@***.***> wrote: I feel both real life use cases of rate limiting and how popular sites use rate limiting are quite similar. I might have to replace the section header on where i discussed Twitter's adoption of rate limiting and its usage. Thank you On Mon, 13 May 2024, 11:02 Theodore Kelechukwu Onyejiaku, < ***@***.***> wrote: > Hi @oluwatobi2001 <https://github.com/oluwatobi2001>, > > Your time and effort is very well appreciated. I have left a comment on > your draft. > > I could not find this heading in your draft. > > - How Popular Social Media sites like Twitter and co add rate > limiting. > > — > Reply to this email directly, view it on GitHub > <#1316 (comment)>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AGW7FFNRXEPI4ULHWC25HU3ZCCFUXAVCNFSM6AAAAABFRVFLT6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCMBXGE2TOMZWGA> > . > You are receiving this because you were mentioned.Message ID: > ***@***.***> >

[Theodore-Kelechukwu-Onyejiaku]

Hi @oluwatobi2001 ,

I hope you are doing great! Please you haven't incorporated the changes I asked for. Please incorporate them so we don't go back and forth.

Thank you.

[oluwatobi2001]

Good day Sir. I have addressed the 2 comments you raised. I am currently addressing the last comment you made on the real life use cases. It would be on the article before the end of the day. Thank you.

…

On Tue, 14 May 2024, 07:27 Theodore Kelechukwu Onyejiaku, < ***@***.***> wrote: Hi @oluwatobi2001 <https://github.com/oluwatobi2001> , I hope you are doing great! Please you haven't incorporated the changes I asked for. Please incorporate them so we don't go back and forth. Thank you. — Reply to this email directly, view it on GitHub <#1316 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AGW7FFMBG5H3DTHZOHSXDYDZCGVDNAVCNFSM6AAAAABFRVFLT6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCMBZGM4DEMBXGI> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[oluwatobi2001]

good day sir. i have included the section requested. thanks.

…

On Tue, 14 May 2024, 08:18 oluwatobi joshua, ***@***.***> wrote: Good day Sir. I have addressed the 2 comments you raised. I am currently addressing the last comment you made on the real life use cases. It would be on the article before the end of the day. Thank you. On Tue, 14 May 2024, 07:27 Theodore Kelechukwu Onyejiaku, < ***@***.***> wrote: > Hi @oluwatobi2001 <https://github.com/oluwatobi2001> , > > I hope you are doing great! Please you haven't incorporated the changes I > asked for. Please incorporate them so we don't go back and forth. > > Thank you. > > — > Reply to this email directly, view it on GitHub > <#1316 (comment)>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AGW7FFMBG5H3DTHZOHSXDYDZCGVDNAVCNFSM6AAAAABFRVFLT6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCMBZGM4DEMBXGI> > . > You are receiving this because you were mentioned.Message ID: > ***@***.***> >

[Theodore-Kelechukwu-Onyejiaku]

Hi @oluwatobi2001 ,

Thank you so much. I will review it soon. Meanwhile, I observed your images are quite blurry. Please do well to fix them.

Please do well to join our Discord community channel if you haven't, https://discord.gg/invite/strapi. 😊

[oluwatobi2001]

Noted with thanks.

…

On Mon, 1 Apr 2024, 17:50 oluwatobi joshua, ***@***.***> wrote: Good day editor, I wrote the outline within the issue .Thanks On Mon, 1 Apr 2024, 17:30 Theodore Kelechukwu Onyejiaku, < ***@***.***> wrote: > Hi @oluwatobi2001 <https://github.com/oluwatobi2001> , > > This looks good! Could you please provide an outline. Thank you. > > — > Reply to this email directly, view it on GitHub > <#1316 (comment)>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AGW7FFOH3F2IJOECQBMMDHTY3GDTJAVCNFSM6AAAAABFRVFLT6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMZQGEYDQNRWG4> > . > You are receiving this because you were mentioned.Message ID: > ***@***.***> >

[oluwatobi2001]

Sorry please i'm yet to get any additional comments on the work done so far and any plans for it to be published On Sat, May 18, 2024 at 4:17 AM oluwatobi joshua ***@***.***> wrote:

…

Noted with thanks. On Mon, 1 Apr 2024, 17:50 oluwatobi joshua, ***@***.***> wrote: > Good day editor, I wrote the outline within the issue > .Thanks > > On Mon, 1 Apr 2024, 17:30 Theodore Kelechukwu Onyejiaku, < > ***@***.***> wrote: > >> Hi @oluwatobi2001 <https://github.com/oluwatobi2001> , >> >> This looks good! Could you please provide an outline. Thank you. >> >> — >> Reply to this email directly, view it on GitHub >> <#1316 (comment)>, >> or unsubscribe >> <https://github.com/notifications/unsubscribe-auth/AGW7FFOH3F2IJOECQBMMDHTY3GDTJAVCNFSM6AAAAABFRVFLT6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMZQGEYDQNRWG4> >> . >> You are receiving this because you were mentioned.Message ID: >> ***@***.***> >> >

[oluwatobi2001]

Hello, please any response so far?

…

On Thursday, May 30, 2024, oluwatobi joshua ***@***.***> wrote: Sorry please i'm yet to get any additional comments on the work done so far and any plans for it to be published On Sat, May 18, 2024 at 4:17 AM oluwatobi joshua ***@***.***> wrote: > Noted with thanks. > > On Mon, 1 Apr 2024, 17:50 oluwatobi joshua, ***@***.***> wrote: > >> Good day editor, I wrote the outline within the issue >> .Thanks >> >> On Mon, 1 Apr 2024, 17:30 Theodore Kelechukwu Onyejiaku, < >> ***@***.***> wrote: >> >>> Hi @oluwatobi2001 <https://github.com/oluwatobi2001> , >>> >>> This looks good! Could you please provide an outline. Thank you. >>> >>> — >>> Reply to this email directly, view it on GitHub >>> <#1316 (comment)>, >>> or unsubscribe >>> <https://github.com/notifications/unsubscribe-auth/AGW7FFOH3F2IJOECQBMMDHTY3GDTJAVCNFSM6AAAAABFRVFLT6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMZQGEYDQNRWG4> >>> . >>> You are receiving this because you were mentioned.Message ID: >>> ***@***.***> >>> >>

[Theodore-Kelechukwu-Onyejiaku]

Hi @oluwatobi2001 ,

I just took a look at your article once more. Could you please ping me the following on Discord:

• Full Name
• Photo
• Bio
• Job Title
• Twitter Handle

Thank you for your contribution once again! If I need any other thing from you, I will let you know! 💪

[Theodore-Kelechukwu-Onyejiaku]

Hi @oluwatobi2001 ,

I left some comments in your work. Please review and implement. Thank you for your patience and contribution to the "Write for the Community" program!

[oluwatobi2001]

Good day . I have fixed all comments. Thank you

…

On Wed, Jun 5, 2024, 12:29 Theodore Kelechukwu Onyejiaku < ***@***.***> wrote: Hi @oluwatobi2001 <https://github.com/oluwatobi2001> , I left some comments in your work. Please review and implement. Thank you for your patience and contribution to the "Write for the Community" program! — Reply to this email directly, view it on GitHub <#1316 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AGW7FFPT3ZTASNL5C2I53C3ZF3ZCNAVCNFSM6AAAAABFRVFLT6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCNBZGU4TQNRQGA> . You are receiving this because you were mentioned.Message ID: ***@***.***>