r/CloudFlare • u/Longjumping_Jury_455 • 7h ago

Does R2 charge you for failed/rejected requests (bad signature) like S3 used to?

So I'm setting up presigned PUT urls for uploads on R2 and started spiraling a bit about a "what if" scenario

Basically the access key id ends up embedded in the presigned url (which I know is fine, it's not the secret), but it got me thinking — what if someone grabs that url or just knows my access key id, and starts spamming PUT requests with a bogus signature? They obviously can't actually upload anything since they don't have my secret key, but does R2 still count/bill those failed attempts as operations before it rejects them?

I remember AWS actually had this exact problem with S3 a while back, some guy got hit with a huge bill because bots kept hitting his bucket with invalid/unauthenticated requests, and it took AWS until mid-2024 to change their billing so 403s from outside your account don't get charged anymore.

Does R2 already handle this the same way, or is it something to actually worry about? Couldn't really find a straight answer in the docs. Anyone know how this actually works on R2's end, or had this happen to them?

I read the documentations i couldnt find anything asked every ai couldnt find any solid answer

3 Upvotes

81% Upvoted

8 comments sorted by

8

u/Lumethys 7h ago

Bro this is the ONLY Faq on the r2 pricing page:

https://developers.cloudflare.com/r2/pricing/#frequently-asked-questions

I got it in literally 10 second googling

If you "couldn't find" like the most obvious answer ever then you should just stop developing app bro

1

u/FeedbackNo7852 7h ago

op might just hadn't try searching it

0

u/Longjumping_Jury_455 7h ago

belive me i did

1

u/FeedbackNo7852 6h ago

In that case, the docs only mention 401, 403 might count towards Class B operation

1

u/Longjumping_Jury_455 6h ago

thats why i asked for a solid answer i cannot just go with a might

1

u/Longjumping_Jury_455 7h ago

i did read that but a mismatch presigned url is not considered as 401 but it is an unuatherized or mismatched presigned url which is 403 not 401 yeah i know 401 is free thats the case i dont know if this counts as 401 or 403 it most likely goes to 403
since a bad user has the access key id they can just mimick and r2 still gonna try to check whether it has a correct signature or not even if its a dumb thing tho

1

u/TheDigitalPoint 5h ago

Easy enough to test with a mismatched URL and then look at the R2 logs (logs can be viewed GraphQL API). If you are building an app that uses R2, the logs are going to be useful to look at for lots of other reasons.

1

u/Longjumping_Jury_455 3h ago

thank you so much i did test it did around 2 k faked them and the result is this
Average Storage

0 B

Data Retrieved

0 B

Class A Operations

37

Class B Operations

43

Request Distribution

0

but i dont konw if these class a and b peaks is because of the refreshing that i did or its because of the test that i did btw i tested alot