Although so far the INI files are readily available, this is problematic and we get a huge amount of abuse.
My idea was this: in order to download the files, you must generate an API key. Generating the API key shouldn't need an account or anything, but we could probably use a Google reCaptcha or something.
The API keys should expire (maybe in 1 year or something), and probably makes sense to be a JWT as the key, then we don't even need to store anything.
Basically anything without an API key would now be blocked.
Although so far the INI files are readily available, this is problematic and we get a huge amount of abuse.
My idea was this: in order to download the files, you must generate an API key. Generating the API key shouldn't need an account or anything, but we could probably use a Google reCaptcha or something.
The API keys should expire (maybe in 1 year or something), and probably makes sense to be a JWT as the key, then we don't even need to store anything.
Basically anything without an API key would now be blocked.