{"action":"opened","issue":{"url":"https://api.github.com/repos/evonove/django-oauth-toolkit/issues/254","labels_url":"https://api.github.com/repos/evonove/django-oauth-toolkit/issues/254/labels{/name}","comments_url":"https://api.github.com/repos/evonove/django-oauth-toolkit/issues/254/comments","events_url":"https://api.github.com/repos/evonove/django-oauth-toolkit/issues/254/events","html_url":"https://github.com/evonove/django-oauth-toolkit/issues/254","id":79768360,"number":254,"title":"Rate limit on valid POSTs to /o/token/","user":{"login":"kvogel","id":1649844,"avatar_url":"https://avatars.githubusercontent.com/u/1649844?v=3","gravatar_id":"","url":"https://api.github.com/users/kvogel","html_url":"https://github.com/kvogel","followers_url":"https://api.github.com/users/kvogel/followers","following_url":"https://api.github.com/users/kvogel/following{/other_user}","gists_url":"https://api.github.com/users/kvogel/gists{/gist_id}","starred_url":"https://api.github.com/users/kvogel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kvogel/subscriptions","organizations_url":"https://api.github.com/users/kvogel/orgs","repos_url":"https://api.github.com/users/kvogel/repos","events_url":"https://api.github.com/users/kvogel/events{/privacy}","received_events_url":"https://api.github.com/users/kvogel/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-05-23T07:43:01Z","updated_at":"2015-05-23T07:43:01Z","closed_at":null,"body":"Is it out of scope of django-oauth-toolkit to provide some type of rate limiting to this URL?  \r\n\r\nI found a malicious user who has an account on my server may repeatedly POST using curl for ex. to the /o/token/ url creating one AccessToken and one RefreshToken per request.\r\n\r\nI am using the 'public' application type so no client_secret only client_id.  I thought about using 'confidential' type but then I'd have to change the way I'm deploying my web-app."}}