Implemented as a scalable stateless microservice with no user management or authentication, minimizing damage from potential zero-day breakouts. Do no

Search code, repositories, users, issues, pull requests...

submited by

Style Pass

2024-11-07 13:30:17

Implemented as a scalable stateless microservice with no user management or authentication, minimizing damage from potential zero-day breakouts.

Do not run this service without a reverse proxy or API gateway in front of it. While whipcode does have a standalone mode for per IP rate limiting, it is not meant to be used in production. Use an API gateway like Kong, Tyk and WSO2 to enforce rate limits, policies and authentication. Configure your gateway to add a X-Master-Key header to every request with the secret defined below. Do not host the gateway on the same system. Do not run whipcode as root, or with SELinux disabled/permissive.

-p, --port PORT The port to listen on. May not always work with authbind when attempting to bind to ports < 1024. (default: 8000)

-m, --max BYTES The maximum size of the request body in bytes. Requests larger than this will be rejected. (default: 1000000)