Possible race condition observed with autocert

[jvanasco]

@jsha

because autocert's example code doesn't set an email address, most autocert users don't set one in their configs.

Have you considered issuing a PR to autocert that would do things like:

• cripple the package if they don't set the email address
• set a header that would identify the package and version, so you could throttle/block on a firewall level?

[jsha]

@jvanasco

Have you considered issuing a PR to autocert that would do things like:

I've been meaning to do this, but haven't gotten around to it. If you'd like to do it, please feel free!

@jvanasco

set a header that would identify the package and version, so you could throttle/block on a firewall level?

Autocert does set a package name already, so that's good. What we want mainly is a fix for the bugs that cause excessive traffic. We do have rate limits in place that prevent autocert from causing production impacts, so this is mainly a matter of preventing it from consuming excess resources uselessly. For instance, even when we block a specific user-agent or IP address, our LB or firewall is still doing a certain amount of work to reject each request. Much better to get things fixed at the source.