We had a massive spike in usage this afternoon, 500k WU consumed in an hour. When I look at the usage charts, I can see this was driven by a particular search being run ~2.5k times per minute (way beyond any normal usage pattern). This was happening in the front-end UI, not a backend recursive workflow going off the rails. The particular search happens on page load (and I’ve already gone ahead to update it so that it only happens if the user is logged in, that was a mistake to not already have blocked).
Has anyone run into anything like this, and are there any controls we can / should have with bubble to prevent it from eating so much usage? Is there any way to get credit from the bubble team to offset the cost (it’s not the end of the world, but I would think there should be some rate limiting to prevent this kind of abuse from hitting us?
Yeah I have now gated everything on index to be hidden until “Current User is Logged In” toggles the visibility so searches should fetch until logged in. I had the page-load redirect users to /auth when they were logged out, but because this search was visible before that redirect, it still fired. The search itself was returning no results, but because it suffered from a janky nested search of searches, the frequency ate up a ton of WU.
So I think I’ve mostly solved the issue for the future, but it also seems like the kind of thing that rate limiting in some capacity should prevent? Although I guess if it was some sort of distributed botting across IPs, there might not be much bubble could even do about it
Reach out to support. They could investigate and determine if it was a bot. If it was they may be sympathetic and give some sort of help regarding WU consumed and costs. I think they have a policy still that you get one opportunity for such help.
You may also want to add captcha, most large sites do and it’s always best to look to see what the big players do and attempt to emulate. What you’ve done so far is fine, but I’d imagine a bot can sign up and login.
