1

I'm developing JS and PHP scripts and selling them on various marketplaces. But I need to track/monitor errors on my scripts. Usually, I use Sentry for own web apps, but I'm not sure if it's okay to use it for the scripts which I'm selling. Because this scripts will contain some authentication tokens with write permissions and any experienced developer can see it. So they can abuse it and create thousands of fake errors on Sentry.

What is the correct way to monitor/track errors in this kind of scenario?

  • Why do you need to track/monitor errors on scripts that other people are using? Wouldn't that be the responsibility of the users? – Dan Wilson Oct 11 '18 at 22:51
  • Actually, I need it for automatic error reporting (with the permission of the user). My user audience is not technical people, so I want to keep track of the errors. – Eray Oct 12 '18 at 12:03
  • Was the goal of your bounty to attract more answers? If mine is incomplete, what points weren't covered well enough or at all? – Arseni Mourzenko Oct 19 '18 at 21:46
1
+50

Instead of using the same API key used to send the error logs, use one API key per user. In other words, a person purchasing your library will have to generate his own API key, and then give it to the library he purchased. This way, the person will be identified, and the level of identification depends on your specific needs (it could be a simple e-mail address or much more complete identification process).

This way, you'll avoid most of trouble coming from your customers. Someone who knows he's identified would be much less inclined to DOS or spam your server, because he would believe that legal action from your side will be easier, as well as because he would know that his API key can be blacklisted.

This doesn't solve, however, the trouble coming from the customers of your customers. Imagine Adobe website purchasing your JavaScript library. Adobe starts using it, and makes sure nobody from the staff is abusing the error logs API. But what prevents me, as a simple visitor, from reading the JavaScript source code, extracting the API key, and spam your servers, without being identified?

To solve this second issue, you have to provide for your customers a way for them to filter error logs before sending them to you. What would happen is that instead of interacting directly with your server, the JavaScript library will rather send the error logs to its server-side counterpart, which will consider whether the error messages are legit. This way, it could, for instance, match the error messages to the authenticated users, or keep an eye on an unusual number of messages from a given IP, etc.

This is all but easy to develop, so make sure it's really worth it. The benefit from doing it this way is to save your bandwidth, and the bandwidth can indeed be very costly.

If bandwidth is not an issue, just let all the error messages in. Then, you'll be able to filter them based on the IP address, the number of messages in a given time, the messages themselves or their patterns, etc. After all:

  • If you're low scale (i.e. if you receive a few dozens of error messages per day), filtering spam manually shouldn't be a problem.

  • If you're large scale, receiving thousands of messages per minute, you can leverage the scale in order to identify the abusers and automatically get rid of them.

0

Have the scripts send their log messages to your server then have your server re-send (or not) the messages to Sentry.

This gives you the opportunity to filter out fake errors and it keeps your Sentry tokens on hardware under your control.

  • Dan, thank you for your answer. This time it will cause lots of more problems like load balancing, fake report detection (probably the most difficult one for me), server security. Am I wrong? – Eray Oct 9 '18 at 7:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.