PipedreamHQ / PipedreamHQ/pipedream
[FEATURE] Block unauthorized/spammy HTTP requests without credits usage
- Dominant language
- JavaScript
- Stars
- 11.7k
- Forks
- 5.8k
- Avg merge
- 3d 10h
- Merged PRs (30d)
- 102
Description
I have a form on my website. I want to send the submissions to pipedream with AJAX with pipedream's HTTP request block. The problem is that anyone can find HTTP request endpoint in the code, run AJAX loop in the console and get rid of my credits. We should be able to enable some sort of spam filter when using HTTP request as trigger in our workflow, so we don't lose credits due to high volume spamming.
Adding a domain restriction would not change anything, as if user writes a spamming loop in the console, the domain will still remain the same (authorized).
My suggestion is implementing an option to limit HTTP requests from a specific IP address to wanted amount. For example if user creates a loop that sends requests, only 15 will be handeled, and we will not lose credits for the rest.
```
$(function() {
setInterval(function() {
$.ajax({
url: "endpoint" // Replace with your endpoint
});
}, 100); // 1000 milliseconds = 1 second
});
```
Example of loop spamming I did as a test:

Contributor guide
Assessment
This issue has not been assessed yet.