for my multitenant saas I want to store usage for each tenant usage of workers requests having only 1 worker main backend api. want to track the uages of teach tenant using their StoreId (ecommerce saas). Saving request count on each request (using hono js btw) to KV is a good idea or should I store them in a mysql or is this complete madness any better solutions ?
another concern of mine is people dos attack from localhost or unknown origins. is it possible to only allow traffic from tenant website domain in workers. IG maybe I have to set this up in my api domain security WAF /?
tenant will buy their own domains and host their frontend in that domain where ever they want and I will provide api / database full backend as saas with endposint for making their ecommerce stuff. I will just white list their domains so onl y from tenant domains I get traffic and all other are blocked. cuz or else people will spam my worker endpoints
what about hostnames for example mystore.com is a frontend calling api.mysaasapi.com that's my worker domain (and in mysaasapi WAF I blocked all hostname not equal mystore.com) . what you think can people modify the hostname with api calling.