Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Thanks for your answer! Makes me curious how do you defend against people simply bruteforcing or guessing the account numbers.


Rate limiting when it's invalid (and high entropy to generate new ones)! It's in the FAQ :)




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: