Rate Limiting & Security

Oh My School includes enterprise-grade built-in security features to protect sensitive student data.

Dynamic Rate Limiting

To prevent brute-force attacks and automated scraping, Oh My School implements configurable rate limiting:

• IP-Based Lockout: You can configure the maximum number of attempts per IP address per service.
• Temporary Lockout: If a client exceeds the threshold, they will experience a temporary lockout from that specific service, while other services remain unaffected.
• Configurable Limits: Limits can be set directly in the service settings via the admin panel.

End-to-End Payload Encryption

For high-security environments, Oh My School supports optional End-to-End Encryption (E2EE) for public search requests:

• RSA + AES Hybrid Encryption: When enabled, the search payload is encrypted on the client side (student's browser) using a public key and decrypted on the server using the private key.
• Protection Beyond HTTPS: This provides an extra layer of security, ensuring that even if HTTPS traffic is inspected or terminated at a reverse proxy, the search queries and results remain encrypted in transit until processed by the core engine.
• Toggleable: This setting is configurable per deployment and can be toggled on/off in the application settings dashboard.

Best Practices

• Always Use HTTPS: In production, route your application traffic through a reverse proxy (like Nginx, Caddy, or Traefik) to terminate SSL/TLS.
• Enable Payload Encryption: Turn on RSA + AES payload encryption for highly sensitive portals (such as Exam Scores or Admission Announcements).
• Tune Lockout Thresholds: Set conservative rate limits for high-stakes services to mitigate brute-force lookups.