Consider blocking radio streams

[Rob--W]

The public CORS Anywhere instance is meant to serve as a demo of CORS Anywhere, and to allow web applications to quickly experiment with CORS applications.

It seems that an unusual high number of radio (streaming) proxies are using CORS Anywhere.
I've also received a DMCA complaint that seems to involve a stream site.

Given this kind of abuse, I am considering to severely rate-limit streaming sites, using the mechanism that I introduced for #45 (or something else if that turns out to be insufficient).

[jespertheend]

I was using cors anywhere to test out proxying youtube audio to my web app and it was very useful to see if it would work. But I agree that cors anywhere should not be used in production especially not for copyrighted works like this. So yes it's probably a good idea to rate limit it on streams. I just wantedto let you know it was really usefull for me. Maybe not rate limiting localhost origins is a good idea?

[Rob--W]

It appears that there are two commercial JS libraries that used CORS Anywhere to query radio stream metadata. I have blocked requests from these clients to relieve the server load.

Anyone who uses CORS Anywhere for large volumes should self-host CORS Anywhere, and not use the public demo server.

[Rob--W]

One minute shortly after applying the new block rules:

• 82k requests, 72k of them are to these radio streaming sites.
• 76k rate-limited requests (HTTP 429) (of which 70k are to these radio streams)
• 3k blocked requests (HTTP 403) (of which 2k are to these radio streams)
• 3k proxied requests

Even before the new block, the majority of the radio streaming requests were already blocked. The new block will block all requests, and hopefully these radio sites will catch up and stop using the public CORS Anywhere server.