pasjrwoctx

@webfan the other reason I elected to not have a server side stored is one privacy of actual humans that visit my site directly, and I just rather not be collecting useless data on a fairly restricted shared hosting environment, I am sure with a little time and a bit more effort on my part I could build fort knox around my instance, but the whole point of this was to cut down on the constant abusive bots and scrappers, and at this time it appears to have worked or is working as is;

@webfan also if you wanted to go that far as adding /inbox following the logic you should probably also add /nodeinfo as well;

@webfan cookie could be faked but so can headers, and the way I have it now the cookie is only good for the session, bots and scrapers start a new session every time they probe a domain so no need to store, each time they troll its a new session, putting inbox in the check I guess could be useful to gate it, but when I sat down to do this and dug through all my access logs I did not have even one call for the inbox to be worried about it, now if I get bots or scrapers that start calling for my inbox I will gate it, but my understanding of how friendica and activitypub are setup the inbox should not be callable by bots and scrapers, I maybe wrong on that, I have had this instance up an running a year, and it has be en a lot of learning and trial and error so many errors, but so far this gate has really made my access logs go empty, which for me is good, im still fully federated but the datahogs have slowed or stopped trolling me

@webfan the only reason to exclude the /inbox route is if you are finding a lot of bots and scrapers accessing your inbox before they scrape your profile, in theory friendicas rules and activitypubs rules should already have your inbox blocked from that activity, I created this because even with a very robust .htaccess file I was getting a lot of bots and scrapers accessing "GET" and "Profile" in my access logs, most where defeating my robots.txt and breaking the rules in .htaccess, this at the moment has killed them, first 2 days they all got 403's and then they just stopped trolling my instance at all; I think it could be customized to your individual needs, I made it shareable, I wont maintain it, it works for me and if by chance it helps anyone well all the better, by all means adapt and modify it to your instance's needs and if it works share it with the community, security and privacy in numbers I say;

@csolisr I have no idea about making it an addon, personally I think that defeats the purpose, as this really acts like the first line of defense after .htaccess rules, before anything else even happens, at least that is how I saw it working;