I have an infura link, and put it on my frontend as the default provider url.

What happens if someone DOS's that link and uses up the daily api request limit? It's unclear how infura protects against this.


Actually when you're creating project inside Infura you're allowed to set restrictions like:

  • Public/ private key encryption
  • What is the contract address the node is going to interact with
  • Set requests per second ( or set total for each day )
  • Allowed origins or user agents
  • Allowed methods ( you can allow methods that your project needs and disallow all other methods )

You should just go to your project in Infura and read what security settings you can setup.

  • I've read through all of this. But none of the options indicate how to rate limit against every ip. You can only rate limit the project as a whole. – Dylan Kerler Oct 17 '20 at 9:37
  • Yes, sadly there isn't IP validation. What you could do is if you have backend move the provider settings there and move your Infura API KEY to environment variables which shouldn't be public. Also if you think about it, you cannot set IP validation on front-end level, simply because the IP that sends the request is your app user. Restricting the Infura API for everyone else beside your users will be hard task to do. – Miroslav Nedelchev Oct 17 '20 at 10:00
  • I don’t mind rate limiting my users too. That is pretty poor. It means you can’t use an Infura link on the frontend because anyone can DOS it and use up the rate limit. – Dylan Kerler Oct 17 '20 at 13:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.