From 40920012c3f9de56490b881e0cba8f857a51a7d3 Mon Sep 17 00:00:00 2001
From: Hermes AI Bot <hermes-ai-bot@orfel.de>
Date: Sat, 25 Jul 2026 16:00:21 +0000
Subject: [PATCH] tip #44: Rate-Limit server functions

---
 TIPS.md                                       |  1 +
 ...44-security-rate-limit-server-functions.md | 22 +++++++++++++++++++
 2 files changed, 23 insertions(+)
 create mode 100644 tips/2026-07-25-044-security-rate-limit-server-functions.md

diff --git a/TIPS.md b/TIPS.md
index 0aa810d..16e40fb 100644
--- a/TIPS.md
+++ b/TIPS.md
@@ -36,3 +36,4 @@ Going forward, new tips are pushed automatically by the `mc_survival_tips.py` cr
 - [Tip #41](tips/2026-07-22-041-social-dynamic-og-image-share-previews.md) (2026-07-22) — **social**: Dynamic OG-Image share previews
 - [Tip #42](tips/2026-07-23-042-data-most-viewed-recipes-widget.md) (2026-07-23) — **data**: Most-Viewed Recipes widget
 - [Tip #43](tips/2026-07-24-043-visual-lightbox-for-item-images.md) (2026-07-24) — **visual**: Lightbox for item images
+- [Tip #44](tips/2026-07-25-044-security-rate-limit-server-functions.md) (2026-07-25) — **security**: Rate-Limit server functions
diff --git a/tips/2026-07-25-044-security-rate-limit-server-functions.md b/tips/2026-07-25-044-security-rate-limit-server-functions.md
new file mode 100644
index 0000000..233edbc
--- /dev/null
+++ b/tips/2026-07-25-044-security-rate-limit-server-functions.md
@@ -0,0 +1,22 @@
+---
+tip_number: 44
+date: 2026-07-25
+category: security
+status: pending
+---
+
+# Tip #44 — Rate-Limit server functions
+
+**Date:** 2026-07-25  
+**Category:** security  
+**Source:** MC-Survival Wiki Daily Tip (cron @ 18:00 MESZ)
+
+## Rate-Limit server functions
+
+Apply a token-bucket rate limit per IP to anonymous server functions — for example 60 req/min on search and 10 req/min on write endpoints — and return a 429 with a Retry-After header when the limit is hit. It solves the abuse problem: search, item-pick, and any anonymous write endpoint are obvious targets for scripted abuse, scraping, and accidental loops. The signal is operational: TanStack Start server functions are publicly callable by default, and there is no rate limiting in front of them today, which is fine at 100 users and a real problem at 10,000. An in-memory bucket per server instance is the right starting point — switching to Redis later is a one-function change when multi-instance scale arrives.
+
+## Implementation tips
+
+1. Token-bucket per IP for unauthenticated routes. 60 req/min for search, 10 req/min for writes.
+2. In-memory bucket per server instance is fine for small scale; Redis later when multi-instance.
+3. Return 429 with Retry-After header — don't silently drop.