Known Issues - CSC4790-Fall2024-Org/Sports-Betting-Tool GitHub Wiki

API Overcalling Vulnerability

Issue Description

The application currently allows unlimited manual refreshing of odds data through the "Refresh Odds" button present on multiple pages. There is no rate limiting or cooldown implemented for these refresh requests, which could potentially lead to API overcalling.

Current Implementation

// EventDetail.js
const fetchOdds = () => {
    fetch('http://127.0.0.1:8000/api/odds/')
        .then((response) => response.json())
        .then((data) => {
            // Process data
        });
};

// Refresh button with no rate limiting
<button className="refresh-button" onClick={fetchOdds}>
    <RefreshCcw size={16} />
    <span>Refresh Odds</span>
</button>

Impact

  • Users can repeatedly click the refresh button with no restrictions
  • Potential to exceed API rate limits
  • Risk of being temporarily blocked by the data provider

Needed Improvements

Implementation of rate limiting functionality to prevent excessive API calls, such as:

  • Cooldown period between refreshes
  • Daily refresh limit
  • User feedback for remaining refreshes/cooldown time
⚠️ **GitHub.com Fallback** ⚠️