Getting too many login attempts error though my app uses per user auth apis

799 views
Skip to first unread message

nischalshetty

unread,
Apr 6, 2011, 11:24:46 AM4/6/11
to Twitter Development Talk
420:Returned by the Search and Trends API when you are being rate
limited (http://dev.twitter.com/pages/rate-limiting).
Returned by the Streaming API:
Too many login attempts in a short period of time.
Running too many copies of the same application authenticating with
the same account name.


I'm getting the above error. It's in large numbers. Can someone help?

nischalshetty

unread,
Apr 6, 2011, 11:31:26 AM4/6/11
to Twitter Development Talk
I am getting this for the Unfollow method. This shouldn't happen for
the unfollow API. Can someone at twitter look into it?

-N

Taylor Singletary

unread,
Apr 6, 2011, 11:41:38 AM4/6/11
to twitter-deve...@googlegroups.com, nischalshetty
Unfollowing is not "rate limited" by the API, but we have organic limits on most write actions service-wide to prevent certain kinds of bursty behavior. Best to back off from retrying requests when you get an error like this for an exponentially increasing amount of time -- first 30 seconds, then a minute, then a few minutes, then 10 minutes, etc.

@episod - Taylor Singletary


--
Twitter developer documentation and resources: http://dev.twitter.com/doc
API updates via Twitter: http://twitter.com/twitterapi
Issues/Enhancements Tracker: http://code.google.com/p/twitter-api/issues/list
Change your membership to this group: http://groups.google.com/group/twitter-development-talk

nischalshetty

unread,
Apr 6, 2011, 11:47:59 AM4/6/11
to Twitter Development Talk
Hi,

It's my app http://justunfollow.com It's been running from more than a
year now. I did not see any sudden increase in traffic or any of that
sort. It's hosted on the Google Appengine and there were 2 cases in
the entire year when appengine ips were blocked by twitter.

I have more than 200,000 users. Your advice would be greatly
appreciated. I do not make use of any search or trends api.

-N

On Apr 6, 8:41 pm, Taylor Singletary <taylorsinglet...@twitter.com>
wrote:
> Unfollowing is not "rate limited" by the API, but we have organic limits on
> most write actions service-wide to prevent certain kinds of bursty behavior.
> Best to back off from retrying requests when you get an error like this for
> an exponentially increasing amount of time -- first 30 seconds, then a
> minute, then a few minutes, then 10 minutes, etc.
>
> @episod <http://twitter.com/episod> - Taylor Singletary

Taylor Singletary

unread,
Apr 6, 2011, 12:00:10 PM4/6/11
to twitter-deve...@googlegroups.com, nischalshetty
By running on Google App Engine, or any host where you share IP addresses with another service, you're going to be at a disadvantage when it comes to abuse detection -- my advice would be to ensure you have a queue system in place for API actions you take (really any application servicing anywhere near as many users as you do should have this in place), especially actions applied in bulk -- you will have times that you need to queue up your actions until you can resume making requests -- the best way to detect if you can resume making requests is by intermittently trying a single item at the top of the queue once every few seconds, increasing the duration you wait with every failed request.

You never want to continue bursting when faced with an error like this, it would only make your application appear more abusive to the metrics-oriented unfeeling eye of an abuse detection algorithm.

@episod - Taylor Singletary

nischalshetty

unread,
Apr 6, 2011, 12:02:29 PM4/6/11
to Twitter Development Talk
I just checked my log. The first error was encountered around 6.5
hours ago. Since then it's been occurring in loads continuously :
( This is the first time in the entire year that I'm seeing something
like this and no new code has been pushed to production.

I request you to check if my app is being rate limited or if appengine
ips are being rate limited. My app tries to stay within the limits for
each user and has never been rate limited.

-N



On Apr 6, 8:47 pm, nischalshetty <nischalshett...@gmail.com> wrote:
> Hi,
>
> It's my apphttp://justunfollow.comIt's been running from more than a

nischalshetty

unread,
Apr 6, 2011, 12:07:04 PM4/6/11
to Twitter Development Talk
Though I have so many users, each user has an internal limit of 100
unfollows per day which is well within any sort of limits. That is one
of the reasons why I never implemented any queuing mechanism, such
short number of unfollows can be done instantly.

Besides, there were no sudden spikes in traffic so this sudden rate
limiting baffles me. And automated unfollows are not allowed so I
thought queuing wouldn't be a good idea. I'll try to implement
something like that but what's the short term solution? Can you do
something on your end to remove the rate limit if any that might have
been put on my app?

I have always adhered to twitter limits and rules never going out of
my way. Please help me with this.

-Nischal

On Apr 6, 9:00 pm, Taylor Singletary <taylorsinglet...@twitter.com>
wrote:
> By running on Google App Engine, or any host where you share IP addresses
> with another service, you're going to be at a disadvantage when it comes to
> abuse detection -- my advice would be to ensure you have a queue system in
> place for API actions you take (really any application servicing anywhere
> near as many users as you do should have this in place), especially actions
> applied in bulk -- you will have times that you need to queue up your
> actions until you can resume making requests -- the best way to detect if
> you can resume making requests is by intermittently trying a single item at
> the top of the queue once every few seconds, increasing the duration you
> wait with every failed request.
>
> You never want to continue bursting when faced with an error like this, it
> would only make your application appear more abusive to the metrics-oriented
> unfeeling eye of an abuse detection algorithm.
>
> @episod <http://twitter.com/episod> - Taylor Singletary
>
> On Wed, Apr 6, 2011 at 8:47 AM, nischalshetty <nischalshett...@gmail.com>wrote:
>
>
>
>
>
>
>
> > Hi,
>
> > It's my apphttp://justunfollow.comIt's been running from more than a

nischalshetty

unread,
Apr 6, 2011, 3:07:52 PM4/6/11
to Twitter Development Talk
I cooled down my servers for more than 2 hours now. There were no
activities happening through my app. I turned it back on just a few
minutes back.

The same problem, getting 420 error codes :( Cooling it off again, can
you do something to get me out of this trouble?

-N
> > > It's my apphttp://justunfollow.comIt'sbeen running from more than a

Taylor Singletary

unread,
Apr 6, 2011, 3:44:41 PM4/6/11
to twitter-deve...@googlegroups.com, nischalshetty
There may be others on the IP address you are using abusing the system and making you suffer as a result. 

Do you get a HTTP status code 420 just for unfollow requests or is it for all requests? Have you attempted to perform the operation in isolation from your servers (not tied to your application business logic, perhaps using command line tools or Curl, Twurl, etc.)?

Can you do the following:

1) Issue one of the API calls you're trying to make, taking note of the exact API URL you're executing (tell me which it is)
   (may as well at this time verify that you're using the proper URL structures, including api.twitter.com as the domain "/1/" prepending all resource URLs to indicate the API version)
2) When/if you get the the error response, capture the exact HTTP status code and the raw/exact HTTP body you get in response? (Not as interpreted by any library you're using).


@episod - Taylor Singletary

nischalshetty

unread,
Apr 6, 2011, 8:55:43 PM4/6/11
to Twitter Development Talk
> There may be others on the IP address you are using abusing the system and
> making you suffer as a result.

Probably but then this had happened twice as I said earlier and both
the times none of the api's worked until one of you guys removed the
ips from the blacklist.

> Do you get a HTTP status code 420 just for unfollow requests or is it for
> all requests? Have you attempted to perform the operation in isolation from
> your servers (not tied to your application business logic, perhaps using
> command line tools or Curl, Twurl, etc.)?

I'm getting it for Unfollow requests only. It does not throw errors
when I try it individually even on my own server. I had a test url set
up and it did not throw error on unfollowing around 200 users. That's
the time I made it live for everyone but it started giving the errors
in a few minutes of going live again.

> Can you do the following:
>
> 1) Issue one of the API calls you're trying to make, taking note of the
> exact API URL you're executing (tell me which it is)
>    (may as well at this time verify that you're using the proper URL
> structures, including api.twitter.com as the domain "/1/" prepending all
> resource URLs to indicate the API version)
> 2) When/if you get the the error response, capture the exact HTTP status
> code and the raw/exact HTTP body you get in response? (Not as interpreted by
> any library you're using).

I will do this and revert back. I am using the latest version of
twitter4j and it uses api.twitter.com as the end point.

I had put the servers off for the last 5-6 hours now. I just turned
them back up. I'm hoping the same thing does not start again :(

-N

On Apr 7, 12:44 am, Taylor Singletary <taylorsinglet...@twitter.com>
wrote:
> There may be others on the IP address you are using abusing the system and
> making you suffer as a result.
>
> Do you get a HTTP status code 420 just for unfollow requests or is it for
> all requests? Have you attempted to perform the operation in isolation from
> your servers (not tied to your application business logic, perhaps using
> command line tools or Curl, Twurl, etc.)?
>
> Can you do the following:
>
> 1) Issue one of the API calls you're trying to make, taking note of the
> exact API URL you're executing (tell me which it is)
>    (may as well at this time verify that you're using the proper URL
> structures, including api.twitter.com as the domain "/1/" prepending all
> resource URLs to indicate the API version)
> 2) When/if you get the the error response, capture the exact HTTP status
> code and the raw/exact HTTP body you get in response? (Not as interpreted by
> any library you're using).
>
> @episod <http://twitter.com/episod> - Taylor Singletary
>
> > > > > It's my apphttp://justunfollow.comIt'sbeenrunning from more than a

nischalshetty

unread,
Apr 6, 2011, 8:58:52 PM4/6/11
to Twitter Development Talk
Even as I wrote this and got my servers back up, the 420 errors
started all over again :( Please, can you check on your end using my
app code or something. I can mail you the app id if you want. The app
is justunfollow.com

-N
> > > > > > It's my apphttp://justunfollow.comIt'sbeenrunningfrom more than a

nischalshetty

unread,
Apr 6, 2011, 9:14:36 PM4/6/11
to Twitter Development Talk
Another thing I would like to add is along with these errors I also am
getting a lot of 502 and 503 requests. Do they have to do something
with this?

-N
> > > > > > > It's my apphttp://justunfollow.comIt'sbeenrunningfrommore than a

nischalshetty

unread,
Apr 7, 2011, 2:10:47 AM4/7/11
to Twitter Development Talk
I'm implementing queuing right now. That will hopefully settle things
a little. Once that is done I will provide whatever info I can to get
this thing sorted.

@Taylor I would like to specifically thank you for getting back to me.
Considering the amount of distress calls you guys get, a response time
this quick is awesome. I'm hoping queuing would help me stop all the
420 error codes.

The way I'll be implementing this is :

1. First 420 error occurs, start adding unfollows to Queue
2. Queue would try to unfollow, if error, defer for 10s
3. Keep doubling the check time till it reaches say 10 minutes
4. Keep trying every 10 minutes

I hope this will ease things out and make my app look good to your
abuse detection algorithm :)


I tried searching but did not get any definite write up. Is it
advisable to back off even when there are 502/503/500 error? The
reason I ask is because these errors are quite common and if an app
really starts backing off on these errors then there would be a lot of
lag. But I have a feeling not backing off on these errors is one of
the reasons for the 420 error that my apps encountering, though you
would be the right person to answer this.

-Nischal
> > > > > > > > It's my apphttp://justunfollow.comIt'sbeenrunningfrommorethan a

nischalshetty

unread,
Apr 7, 2011, 1:58:14 PM4/7/11
to Twitter Development Talk
It's just not working. No matter how much I wait, as soon as unfollow
requests start I get the Error Code 420. I have no clue what to do.

Can you please check on your end if my app JustUnfollow.com is being
rate limited for some reason. I've been trying from more than 24
hours. Thousands of users use the app everyday. This is causing a lot
of problem and making me lose users.

I request you, please have a check, I have not changed any code, nor
am I making any new API calls and my API calls did not increase
drastically. I've been running this app over a year now.

It's only the unfollow requests that get the 420 error. My app also
has follow requests which seem to be working fine.

-N
> > > > > > with...
>
> read more »

Matt Harris

unread,
Apr 7, 2011, 3:07:03 PM4/7/11
to twitter-deve...@googlegroups.com
Does the error you get back have any message in the response body?
Also, just so we are absolutely clear which API method you are calling, can you share the exact URL you are hitting and parameters you are sending (obscuring any secure information)


--

Nischal Shetty

unread,
Apr 7, 2011, 4:11:43 PM4/7/11
to twitter-deve...@googlegroups.com
Thank you so much for getting back. I'm using twitter4j version 2.2.1 , it uses all the latest api endpoints.

I could not get the raw response data as there's no easy way to do that using the API and I've been busy  trying to work around the errors my app has been getting.

Here's the message that I get in my log:

420:Returned by the Search and Trends API when you are being rate limited (http://dev.twitter.com/pages/rate-limiting).
Returned by the Streaming API:
Too many login attempts in a short period of time.
Running too many copies of the same application authenticating with the same account name.
--
-Nischal
+91-9920240474
twitter: NischalShetty
facebook: Nischal




nischalshetty

unread,
Apr 7, 2011, 9:01:34 PM4/7/11
to Twitter Development Talk
I'm making around 50-60 unfollow requests per minute and it's still
throwing the error. Did you have a chance to look at it? My site is
unsable :(

-N

On Apr 8, 1:11 am, Nischal Shetty <nischalshett...@gmail.com> wrote:
> Thank you so much for getting back. I'm using twitter4j version 2.2.1 , it
> uses all the latest api endpoints.
>
> I could not get the raw response data as there's no easy way to do that
> using the API and I've been busy  trying to work around the errors my app
> has been getting.
>
> Here's the message that I get in my log:
>
> 420:Returned by the Search and Trends API when you are being rate limited (http://dev.twitter.com/pages/rate-limiting).
> Returned by the Streaming API:
> Too many login attempts in a short period of time.
> Running too many copies of the same application authenticating with the same
> account name.
>
> This is the URL being used :
>
> http://api.twitter.com/1/friendships/destroy.json?include_entities=fa...
>
> -N
>
> On 8 April 2011 00:37, Matt Harris <thematthar...@twitter.com> wrote:
>
>
>
>
>
>
>
> > Does the error you get back have any message in the response body?
> > Also, just so we are absolutely clear which API method you are calling, can
> > you share the exact URL you are hitting and parameters you are sending
> > (obscuring any secure information)
>
> ...
>
> read more »

Taylor Singletary

unread,
Apr 7, 2011, 9:10:36 PM4/7/11
to twitter-deve...@googlegroups.com
We've tested this scenario thoroughly and the limiting ceases after a
short period of time when the maximum levels are reached. We couldn't
reproduce any out of the ordinary behavior.

The most likely culprit in your case is another application performing
unfollows on the same GAE IP address you are on; this happens.
Consider contacting GAE support to see if your app can be moved to a
different IP or some other solution on their side. Consider moving to
a hosting environment that allows you to have your own dedicated IP
addresss.

Taylor

>> >> > > > > > all > ...


>>
>> read more »
>
> --
> Twitter developer documentation and resources: http://dev.twitter.com/doc
> API updates via Twitter: http://twitter.com/twitterapi
> Issues/Enhancements Tracker: http://code.google.com/p/twitter-api/issues/list
> Change your membership to this group: http://groups.google.com/group/twitter-development-talk
>

--

Nischal Shetty

unread,
Apr 7, 2011, 9:22:21 PM4/7/11
to twitter-deve...@googlegroups.com
Oh, so if I send in unfollows from a different IP this would work! Nice, I'll do that.

I've been monitoring my logs, and as you said the blocks are happening at intervals in bursts. Alright, what I will do is set up some service on aws which would do the unfollowing and at the same time I will contact GAE too.

Though I guess a good long term solution is to keep these intensive api calls to a dedicated IP?

Thank you so much for the support, I really appreciate it.

-Nischal

Nischal Shetty

unread,
Apr 8, 2011, 5:39:01 AM4/8/11
to twitter-deve...@googlegroups.com
Moved the unfollow tasks out of GAE. Hoping things go smooth now. Allowing only a subset of users to unfollow. Will gradually allow everyone. Keeping fingers crossed.

-Nischal

Nischal Shetty

unread,
Apr 8, 2011, 10:26:45 AM4/8/11
to twitter-deve...@googlegroups.com
Help! 

I guess my ordeals are not over yet :( It's painful. I created a new module and hosted it on aws. I opened it up to a subset of followers and bang, the rate limit error appears again! Now I'm confident it's my app that is being rate limited and rate limited ONLY for Unfollow calls. 

I haven't had any peace from the last 48 hours due to this. I request you to please look into this. Should I  try resetting the twitter keys of my app? Will doing that help?

Please help me out, things look all gloomy right now. It's the same Error code 420.



-N

Nischal Shetty

unread,
Apr 8, 2011, 10:50:17 AM4/8/11
to twitter-deve...@googlegroups.com
Ok wait. I just gave a brand new static ip to my instance on EC2. Sorry, I don't know how these things work, it's been a few hours since I started with this. I'll update soon on what happens now. Though if you find time then having a look again just to confirm that JustUnfollow isn't being blocked would be a big relief.

-Nischal

Taylor Singletary

unread,
Apr 8, 2011, 10:55:15 AM4/8/11
to twitter-deve...@googlegroups.com, Nischal Shetty
Can you tell me how many unfollows you're doing per minute/per 5 minutes/per 10 minutes and per hour? Do you track these metrics? Are there means to automate the UI of your site that it could be being abused?

It's not possible for us to rate limit your application specifically for this single method, it's purely based on IP address -- so that's not what's happening -- an unpublished, subject to change limit on unfollows will always apply to each and every IP address.

@episod - Taylor Singletary

nischalshetty

unread,
Apr 9, 2011, 1:00:54 AM4/9/11
to Twitter Development Talk
Just in case someone with a similar problem lands on this thread, I
would like you to know that there is a limit on the number of
unfollows per IP and distributing this over multiple IPs helped me
solve my problem. However, you really do not need to bother much about
it unless you start making thousands of requests per hour.

FYI,

@episod and I exchanged a few more emails and with his help and advice
I could solve this problem.

The twitter API team is insanely fast(considering the scale at which
they operate) when it comes to helping out devs like me when in
trouble. This is the second time I've had quick responses over a
critical issue. Kudos to you guys.

-Nischal


On Apr 8, 7:55 pm, Taylor Singletary <taylorsinglet...@twitter.com>
wrote:
> Can you tell me how many unfollows you're doing per minute/per 5 minutes/per
> 10 minutes and per hour? Do you track these metrics? Are there means to
> automate the UI of your site that it could be being abused?
>
> It's not possible for us to rate limit your application specifically for
> this single method, it's purely based on IP address -- so that's not what's
> happening -- an unpublished, subject to change limit on unfollows will
> always apply to each and every IP address.
>
> @episod <http://twitter.com/episod> - Taylor Singletary
>
> On Fri, Apr 8, 2011 at 7:26 AM, Nischal Shetty <nischalshett...@gmail.com>wrote:
>
>
>
>
>
>
>
> > Help!
>
> > I guess my ordeals are not over yet :( It's painful. I created a new module
> > and hosted it on aws. I opened it up to a subset of followers and bang, the
> > rate limit error appears again! Now I'm confident it's my app that is being
> > rate limited and rate limited ONLY for Unfollow calls.
>
> > I haven't had any peace from the last 48 hours due to this. I request you
> > to please look into this. Should I  try resetting the twitter keys of my
> > app? Will doing that help?
>
> > Please help me out, things look all gloomy right now. It's the same Error
> > code 420.
>
> > -N
>
> > On 8 April 2011 15:09, Nischal Shetty <nischalshett...@gmail.com> wrote:
>
> >> Moved the unfollow tasks out of GAE. Hoping things go smooth now. Allowing
> >> only a subset of users to unfollow. Will gradually allow everyone. Keeping
> >> fingers crossed.
>
> >> -Nischal
>
> >> On 8 April 2011 06:52, Nischal Shetty <nischalshett...@gmail.com> wrote:
>
> >>> Oh, so if I send in unfollows from a different IP this would work! Nice,
> >>> I'll do that.
>
> >>> I've been monitoring my logs, and as you said the blocks are happening at
> >>> intervals in bursts. Alright, what I will do is set up some service on aws
> >>> which would do the unfollowing and at the same time I will contact GAE too.
>
> >>> Though I guess a good long term solution is to keep these intensive api
> >>> calls to a dedicated IP?
>
> >>> Thank you so much for the support, I really appreciate it.
>
> >>> -Nischal
>
> >>> On 8 April 2011 06:40, Taylor Singletary <taylorsinglet...@twitter.com>wrote:
>
> >>>> We've tested this scenario thoroughly and the limiting ceases after a
> >>>> short period of time when the maximum levels are reached. We couldn't
> >>>> reproduce any out of the ordinary behavior.
>
> >>>> The most likely culprit in your case is another application performing
> >>>> unfollows on the same GAE IP address you are on; this happens.
> >>>> Consider contacting GAE support to see if your app can be moved to a
> >>>> different IP or some other solution on their side. Consider moving to
> >>>> a hosting environment that allows you to have your own dedicated IP
> >>>> addresss.
>
> >>>> Taylor
>
> >>>> On Thursday, April 7, 2011, nischalshetty <nischalshett...@gmail.com>
> >>> twitter: NischalShetty <http://twitter.com/nischalshetty>
> >>> facebook: Nischal <http://facebook.com/nischal>
>
> >>> <http://www.justunfollow.com>
>
> >> --
> >> -Nischal
> >> +91-9920240474
> >> twitter: NischalShetty <http://twitter.com/nischalshetty>
> >> facebook: Nischal <http://facebook.com/nischal>
>
> >> <http://www.justunfollow.com>
>
> > --
> > -Nischal
> > +91-9920240474
> > twitter: NischalShetty <http://twitter.com/nischalshetty>
> > facebook: Nischal <http://facebook.com/nischal>
>
> ...
>
> read more »
Reply all
Reply to author
Forward
0 new messages