A device fingerprint identifies or associates a client by recording device-related request details. It helps reveal whether unusual endpoint traffic comes from one client, user, region, or coordinated source. section 11.6
Use a device fingerprint to make endpoint-abuse responses more precise:
- Capture it with the client IP and, for authenticated endpoints, the user ID. section 11.6
- Analyze request levels by user, IP, device fingerprint, and region to establish reasonable thresholds. section 11.6
- Rate-limit clients that exceed thresholds and consider blacklisting persistent offenders. section 11.6
Protected order endpoint
For POST /orders, record the request’s client details alongside the authenticated user. Comparing these records over time can distinguish a single abusive client from a general traffic spike. section 11.6
