As a corollary, I thought it naive that the author thought that there shouldn't be some kind of rate limiting in the UI.
If there wasn't, one could reverse engineer the API calls that the UI makes, in order to gain access to un-limited calls.
A good lesson for developers - even though you may have a developer API, you should still consider your public interface as an API, because it can (and will) be reverse engineered.
Even better - use exactly the same, publicly accessible APIs in your front-end!
Comments
As a corollary, I thought it naive that the author thought that there shouldn't be some kind of rate limiting in the UI.
If there wasn't, one could reverse engineer the API calls that the UI makes, in order to gain access to un-limited calls.
A good lesson for developers - even though you may have a developer API, you should still consider your public interface as an API, because it can (and will) be reverse engineered.
Even better - use exactly the same, publicly accessible APIs in your front-end!