API connection timeout about bisq-markets HOT 8 CLOSED

@dan-da, could you accept your invitation to join the @bisq-network GitHub organization? I'll assign you to this issue and add you to the @bisq-network/markets-maintainers team.

from bisq-markets.

Could this issue be closed at this time, or is it still an active problem?

from bisq-markets.

(no opinion on closing or not, sorry)
But I profit to say that, from my experience, atm 30 consecutive http requests is enough to have the IP blocked.
If it would be possible to have a bit more, that would be nice.

from bisq-markets.

@dan-da Could you jump in here?

from bisq-markets.

Present settings are that 30+ requests in 2 minutes will get your IP banned temporarily.

This was put in place to mitigate a ddos attack in early July and it performed well, with website responses going from unusable to quick.

That was before a caching improvement was deployed, so the server should be able to handle more load now.

That said, I don't yet see a compelling reason to raise the limit. All well-behaving API clients can rate limit to 4 secs between API requests.

An improvement would be to document minimum 4 secs between requests (30 reqs in 2 mins) at https://markets.bisq.network/api/

If the limit is causing any problems for browser sessions, no one has filed an issue for that since the limit was lowered.

from bisq-markets.

Thanks for the precisions @dan-da .
I used a timer, but with too small values which seemed to change nothing to the ban.
I'll do it with 4 secs if that makes it.

... I find however that going from 180 req/min to 15 req/min is a bit rude.

from bisq-markets.

I find however that going from 180 req/min to 15 req/min is a bit rude.

Agreed it is not ideal. Again though, it was put in place to mitigate a ddos attack that was killing the site. Bisq is quite limited on server resources so we have to make do within constraints.

This is the first comments I've seen about it since the limit was lowered.

At this point with the caching in place and current traffic I feel it could safely be raised to 60 reqs in 120 secs ( 2 secs per req ) and still withstand a ddos, if not too huge.

That said, hopefully traffic will continue increasing, so our present server resources will scale approx twice as far if we continue with the 4 secs. So I'm leaning towards keeping status quo for now.

Either way, I think the most important thing is to document the limit.

anyone want to weigh in on this before I make any change? any use cases that are seriously adversely impacted by a 4 sec limit? or has anyone heard complaints of browser sessions being banned?

from bisq-markets.

@dan-da , do you have access to the stats for https://markets.bisq.network/api/ frequentation ?
I would be curious to know how much it's used, and if it is growing or not ?

As for the 15 req/min limit, if increasing it puts a risk concerning DDOS, it's ok to let it as it is.

from bisq-markets.