gurix/wecker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: document API security considerations and rate-limiting recommendation

Browse Source
This commit is contained in:
gurix
2026-06-18 17:22:55 +02:00
parent 8a46ff8487
commit b2bb5bdaf9
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+6
View File
@@ -60,6 +60,12 @@ Instead of manually editing your crontab, this project provides a simple GraphQL
**Authentication:** All requests to the `/graphql` endpoint require a custom header: **Authentication:** All requests to the `/graphql` endpoint require a custom header:
`X-API-Key: <YOUR_API_KEY>` `X-API-Key: <YOUR_API_KEY>`
### Security Considerations
* **Keep the API key secret.** Treat it like a password: store it only in `.env`, rotate it periodically, and generate a strong key with `python3 -c "import secrets; print(secrets.token_urlsafe(32))"`.
* **The API currently does not implement rate limiting.** The safest deployment is to expose it only on your local network or through Tailscale. If you expose it to the internet, place it behind a reverse proxy (e.g., nginx, Caddy, or Traefik) that handles TLS and brute-force protection.
* If you need built-in rate limiting, consider adding `slowapi` or a similar ASGI middleware later.
### Example API Usage ### Example API Usage
**Check if alarm is currently ringing:** **Check if alarm is currently ringing:**