Limits against abuse: codes per number per hour and the wait between resends

Security·· 13 views· 3 min read

The short answer: your account has two rules for verification codes, and by default both are off (value 0): resend_wait_seconds, the wait between resends of the same code (up to 3,600 seconds, one hour), and max_codes_per_number_per_hour, the maximum number of codes, new and resent, each number can receive in an hour (up to 1,000). Turn them on before opening your form to the public.

The two rules

Rule What it stops Values
resend_wait_seconds Repeated resends of the same code: the “Resend” button pressed over and over 0 (no limit, the default) to 3,600 seconds
max_codes_per_number_per_hour Many codes to the same number: new and resent both count 0 (no limit, the default) to 1,000 per hour

The rules apply to the whole account, to every key and every app. You do not send them with each code.

Where to change them

1 In My MozOut, on the API keys page: the same rules, without writing code.
2 Through the API, with GET /v1/sms/otp-settings to read them (sms:read permission) and PUT /v1/sms/otp-settings to change them (sms:write permission). Send only what you want to change; 0 removes the limit.

curl -X PUT https://api.mozout.com/v1/sms/otp-settings \
-H "Authorization: Bearer prod_..." \
-H "Content-Type: application/json" \
-d '{"resend_wait_seconds": 60, "max_codes_per_number_per_hour": 5}'

The values in the example are only a starting point: a minute between resends and five codes per number per hour are enough for genuine mistakes and stop abuse. Adjust them to your case.

With a Sandbox key, the change is simulated. In the Sandbox, writes do not change the account: the response includes "simulated": true and the rules stay as they were. To change them for real, use a Production key or My MozOut.

What these rules do not do

They limit by number. Someone abusing a form usually requests codes for many different numbers, and each number stays under the limit. So you also need brakes in your own system: by IP address, by session, a captcha and an alert when volume goes beyond normal. It is all in fraud through your code form.

When a limit is reached, the API refuses the request and says how long to wait. Show the customer a simple message such as “Too many codes requested. Please try again shortly.”, and see how to read the verification API's answers.

Want to stop abuse of your verification codes? See Verification SMS.

See Verification SMS

SEE ALSO

SMS fraud through your code form: how credits get burnt and how to stop it

Resending, cancelling and replacing a verification code: what happens to the old one

Reading the verification API's answers: valid false, 409, 422 and 429

Code length, validity and attempts: choosing length, expires_in and max_attempts

How much SMS verification costs: credits per code, free checks and a monthly estimate

An API key or token has leaked: what to do, in the right order

RECOMMENDED PRODUCT

Web hosting with cPanel

Domain and SSL included, daily backups and the panel you already know. from $6.60/mo (3-year plan, with coupon)

See plans
Was this answer helpful? Your answer helps us improve this article.

Related Articles

Security 2,314 What is an SSL certificate and why does it matter? An SSL certificate encrypts the connection between a visitor's browser and your site, so passwords, card numbers and any...
Security 2,348 Why does my SSL certificate show fewer than 365 days? If you're on the free SSL every account gets by default, this doesn't apply to you - skip to the note below. This is onl...
Security 3,925 How to redirect HTTP to HTTPS with .htaccess This forces every visitor to the encrypted version of your site, even if they type or link to the plain http:// address....
Security 2,253 How to tell if your site has been compromised Most infections don't announce themselves - they show up as small, odd symptoms before anything looks obviously wrong. S...
Security 2,134 How to clean up a compromised site Cleaning up is only half the job - if the door that let the infection in stays open, it comes back. Work through this in...
Security 17 SMS fraud through your code form: how credits get burnt and how to stop it The short answer: to an abuser, a form that sends SMS codes is a button that spends your credits. Bots type numbers in s...