Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: better prevention and handling of exhausted tokens #362

Open
2 tasks
SgtPooki opened this issue May 5, 2023 · 0 comments
Open
2 tasks

fix: better prevention and handling of exhausted tokens #362

SgtPooki opened this issue May 5, 2023 · 0 comments

Comments

@SgtPooki
Copy link
Contributor

SgtPooki commented May 5, 2023

We have a few routes forward to mitigate this:

Method User Auth flow required? Benefits Risks Notes
More github PATs No * Users don't need to authenticate * Only linearly scalable. * Larger maintenance burden This is what we're currently doing, but with only 2 tokens currently
Client side fetching of content No * Users don't need to authenticate * Reduces the use of rate of exhaustion of existing github PATs * Makes retrieving gh issue data more complicated This method splits the methods we use to obtain data from github, and could cause maintenance issues.
SSO authentication Yes * Users have their own request limits and heavy users don't cause failures for others * Enables write/edit of github issues * Can enable conditionally (when existing github PATs are expired) * Would allow for removal of any backend code if used wholly * More burdensome for users * Not all users are familiar with, or have accounts on, github Ideally, we do not want to force users to authenticate when visiting the site, and only enable this for power users. We could limit every users' number of requests and request they authenticate via SSO when they reach that limit, or alert users of a need to authenticate when PATs are exhausted.

Confirmed tasks

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant