Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

User is able to subscribe to filters where they will never receive an event/message. #670

Open
LiranCohen opened this issue Jan 24, 2024 · 2 comments

Comments

@LiranCohen
Copy link
Member

As discussed in the RecordsSubscribe PR (#667)

[...] this does bring up a point: doesn't this mean we allow anyone to subscribe to "nothing" which essentially is a very simple mechanism for DDOS? I do wonder if it is worth while thinking about prevention/mitigation further, even if outside the scope of this PR.

Originally posted by @thehenrytsai in #667 (comment)

@alanhkarp
Copy link

How do you know the subscriber will never receive an event or message?

Are the conditions are inconsistent, e.g., end date is earlier than start date? I'd say you should return an error message.

Does the filter specify some non-existent resource? I think you accept the subscription because the resource might be created later.

What other conditions could result in never receiving an event or message?

@alanhkarp
Copy link

I don't understand the DDOS remark. Isn't a subscription that returns a lot of stuff a more likely DDoS than one that never returns anything?

DDoS is a big topic that warrants a separate discussion covering all aspect of the spec.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants