I'm designing an API. To avoid abuse, I need to rate limit the requests somehow, but I don't want to do it per user as it's very easy to create new accounts automatically. I think a proof of work algorithm would do this job well, but I thought I would ask an expert, i.e. this community.
These are the properties I would like:
- Stateless, but ahead of time setup of state, such as creating a user account, is ok. Two subsequent requests may hit different servers before they have shared their state with each other.
- Preferably zero round trip time, i.e. the user does not have to ask a server what work it should do before actually doing it. This basically implies that the requests are stateless.
- Requests should be able to run in parallell, even for the same user.
- Adjustable difficulty.
I can think of some systems that fulfill some of the above properties, but not all.
userid + (request id) + nonceuntil the prefix of the hash has n bits of zeroes.
Request idis some unique number picked by the client. Has properties 2, 3, 4, since we have to keep track of what request-ids have been used already. Otherwise, the same proof-of-work can be used for multiple requests.
userid + (request-id) + nonceuntil the prefix of the hash has n bits of zeroes. Request-id is fetched from the server before each request. Has properties 3, 4 and optionally 1, if there's some way to validate that the request-id was generated by one of our servers without touching a database. Since we have to ask the server for a request-id, we need one additional roundtrip time.
Is there a proof of work system that provides all the properties I've listed?