When an anon user edits and either uses a browser that does not support client hints or blocks the REST API URL manually, the client hints data is never stored. This means that any other user connecting through this IP address could store arbitrary client hints data for this action, by sending a request to the API.
While this is unlikely to happen, it should be guarded against where possible. This should be done by limiting the time that a user who is allowed to make the API request can have to submit the data. In all cases where the submission is caused by an edit, this will be made moments after. However, in the case of manual experimentation, this could be done hours later.
The cut-off should account for users on slow internet connections and therefore should be set to give enough time to make the request.
Thanks to @dom_walden for spotting this.
Acceptance critera
- Limit the time period that another user could submit client hints data if the user making the edit blocks the client hints API url.
