Throttling about lightning-charge HOT 2 CLOSED

I think that throttling could be a good enhancement indeed. Spamming services with invoice creation could be a potential DoS vector.

However, the Lightning Charge invoice creation API is protected with an API access token and should not normally be exposed directly to the outside world, so I'm not sure if it would be the right place to add this. Perhaps it would be better to have rate-limiting logic in the upper layer that interacts with users instead?

I'm also not sure that we would want to always rate limit API consumers. There might be valid cases where one would want to use the API to create many invoices on its own lightning node, which we should not limit.

One solution is to have multiple API tokens, where some could be rate-limited while others are not. But this would introduce quite some extra complexity into Charge.

Another solution is to have a separate layer on top of Charge, which is meant to be directly exposed to the outside world, then add rate-limiting there. This layer should also expose a more limited set of API functionality (you can create invoices and fetch your own invoices, but can't get the whole list of invoices or access the full stream of incoming payments).

How would you suggest to go about implementing this?

from lightning-charge.

You are correct, It may actually need to be handled in the layer above LightningCharge

from lightning-charge.