We recently launched an internal website. This website doesn’t have a landing page and provides the feature on a URL path. We wanted to redirect all requests navigating the root path / to the feature page using nginx. Here’s how we solved it. {{outline}} Redirect the Root URL Path …

Rate limiting is a security feature that comes with costs you need to manage. For example, once enabled, rate limiting applies to all requests going through your server. This can cause problems when using the rate limiter for both, APIs and web apps. Sending requests to web applications will render …

Introducing the rate limiter into your web application brings security benefits, but requires extra work to integrate it smoothly. In the previous tutorial, you added support to render a “rate limit exceeded” web view instead of sending a JSON response. The web view to show an exceeded limit was dragging …

Your rate limiter has a solid feature set: rate limit requests by IP address or a user identifier, allow dynamic rate limits and use a route-specific rate limit configuration. A missing feature is the support for web views. Up to this point, the rate limiter responds an error in JSON …

Your rate limiter grows in functionality. You already built an IP-based rate limiting that is configurable for each route. The route limits let you configure an individual rate limit for a route that differs from the server’s default rate limit. Another aspect of rate limiting is dynamic rate limiting. …

In the first tutorial, you built an IP based rate limiter. The rate limiter stores the client-related details in Redis. Your setup includes the configuration for global rate limits that apply to each incoming request. In this tutorial, you’ll implement the logic to support individual rate limits for each …

Security is an essential part of your API. It’s your interest to not expose any sensitive user data to the Internet. You’re already hashing the user passwords and store them in an encrypted JWT. Another step in protecting your API endpoints is to secure them against brute-force attacks. …

Building an API requires a lot more stability than web applications. You can’t simply change the endpoint contract. Clients consume your API and expect the data to be in a specific format. For web applications, you’re most likely in charge of the web views and can adjust view …