⬆️ ⬇️

About restrictions

As we know from the theory of the notorious web 2.0, there should be no resource constraints for the user. Photo posting service? There should be no limit on the number of uploaded photos. Bookmark service? There should be no limitations in the number of bookmarks. So you can continue for a very long time - it all comes down to the fact that the processor time and hard disk space in theory is free.



But often both on the web of two resources and on ordinary websites (forums are one of the most vivid examples) we face rather silly restrictions. I will not consider the entire palette of "forbidden fruits", I will describe only one brightest example:



“This forum requires waiting 60 seconds for a new search. You have to wait 56 seconds before the new search. ", VBulletin


As you understood from the text of the error, this is a limitation of the frequency of search queries.



What caused it? The creator of the engine believes that if the user uses the search too often, he will create too much load on the server. In general, it is quite logical, the search server requires a lot of effort. And in fact, the main problem is not the users, but the bots of the attackers.

')

I get this error very often when using all sorts of forums, it is pretty annoying for me to wait half a minute, even for a few seconds. I use a specific forum several times a day (sessions) - every time I do several search queries in a row - I get a mistake several times. This is a shortcomings in usability - and serious - you can not just keep the user to wait.



What solution? Very simple. To do the restriction is not “maximum 1 request in 1 minute”, but, for example, “maximum 60 requests in 60 minutes (hour)”. Thus, I will not receive with my several requests for my session with 3-4 consecutive searches for errors in general, and the bots will fall off as they have fallen off. For very active users, if you exceed “60 for 60”, you can offer to enter a captcha for another 60 requests ahead (if you exceed “1 for 1”, captcha is not a solution, because again the user has to take time).



Bottom line: if before the user does 5 of the search queries he needs in 5 minutes with spitting up errors, now he does it in 1 minute. Both bots did not pass - they never pass.

Source: https://habr.com/ru/post/26603/



All Articles