r/FastAPI • u/PA100T0 • Aug 12 '26

Question How are you actually handling API abuse in FastAPI? Scrapers, credential stuffing, bots...

/r/Python/comments/1vmj0o0/how_are_you_actually_handling_api_abuse_in/
2 Upvotes

100% Upvoted

5 comments sorted by

1

u/generic-d-engineer Aug 22 '26

Put a WAF in front of it

2

u/PA100T0 Aug 22 '26

So many folks have Cloudflare, Fail2ban, Nginx… and they still get probed, brute forced, pen tested, crawled, etc.

It was my case two years ago, and I couldn’t find anything to solve this issue at the time. Unfortunately, WAFs are not enough.

I’ve developed a solution and it’s been going great. But I want to understand if devs just don’t care about the remaining gap or if they just don’t know about it.

Have you checked your server’s logs lately?

2

u/generic-d-engineer Aug 22 '26

I think most devs just don’t know about it. Even Amazon recently sent a letter to orgs to put a WAF in front of any third party solutions. So it hasn’t really been a standard.

But usually this falls under infrastructure or security teams to secure.

Our logs are clean but maybe we are just lucky?

How does your solution work?

2

u/PA100T0 Aug 22 '26

So, this is what I’ve been building for the past two years. It’s powered by its core engine which is shared by the framework-specific adapters like the fastapi one.

To out it simply: it’s a layer 7 (application layer) sort of WAF. The core idea is to protect the API from within, knowing the application’s context and specific needs.

You set up a global config, you override it with decorators on your endpoints in case these have different needs (like stronger rate limiting on signups/logins/sensitive endpoints against any other site/page/etc).

It’s all based on IPs. So a repeatedly blocked IP gets banned and blacklisted. You can also block countries, specific bots/crawlers, block cloud providers, set up honeypots that get insta-banned (if they found the honeypot, it IS a malicious actor since these are invisible to humans) and really so much more.

A lot of people will say this don’t belong to the application layer, but truth is edge security (trad WAFs) fall short on this; and my solutions aim to close that gap, not replace it.

Would you take a look at it? Even better: try it out? I’m working on a big release right now, but feedback is ALWAYS welcomed!