Multiple clicks on short url in few seconds

[tedo-develop]

Hello Acelaya,

we have a new "problem"/feature request.
For some time we have problems with multiple clicks on short-urls. The urls are clicked in few seconds from the same ip-address.

I'm very sure that these clicks from bots. We have urls with 10 clicks or more in just 30 seconds.
Is there any chance to prevent such false clicks?

For testing we have set the REDIRECT_CACHE_LIFETIME=360 but this doesn't help for this problem.

Is there any option we can use for this problem?

Thanks for your help.

[acelaya]

The REDIRECT_CACHE_LIFETIME env var does nothing on its own. It is meant to be used together with REDIRECT_STATUS_CODE=301.

However, if the requests are coming from bots, nothing prevents them from ignoring that and perform new requests anyway.

Let's try it though, and see if it helps.

[tedo-develop]

Hallo Acelaya,

unfortunately that doesn't work. We have already set the cache lifetime and the redirect code.
The only solution that work is the exclude of the IPs. But if we have to exclude every ip we'll never finish.

Is it possible to add a new .env variable to set a tracking delay on ip area?
Maybe some think like this: DELAY_TRACKING = 2 (seconds)?

Thanks for your help

[acelaya]

I think that would be the wrong way to solve this problem. Mostly just a workaround for a side effect that any web application can suffer.

In fact, there's no way to implement something like this in a performant way (as it requires extra queries with date checks), and you would be affecting your real users, and adding extra processing to every request, which in case of bots could result in a DDoS to your instance.

In short, bot protection is not Shlink's responsibility, so I would recommend putting a service whose purpose is that in front of Shlink.

At my company we use Akamai, but it's a SaaS, and quite expensive. If you need some self-hosted open source alternatives, I believe traeffik supports this to some extent, but a search for "bot protection proxy" should throw some results.

[tedo-develop]

Thanks for your hints. We'll try this.