Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We have Ajax call to validate the UserID on create page so that user there only can know if their chosen ID is available or not.

We have this URL exposed : https://mydomain.com/validateId?id=<user enter value>

Lately some hackers are sending large amount of concurrent requests to this URL and we are observing very high load on CPU's even to 100%

We don’t have any session identifiers available in the action for that Ajax calls. What technique can we use to prevent so many direct concurrent calls? Any way to identify if the users are firing these Ajax calls from the create pages and not directly using some malicious tools?

share|improve this question

1 Answer 1

up vote 3 down vote accepted

It looks like you're being targeted by a determined attacker, so you should immediately start by implementing rate-limiting measures. I highly recommend using fail2ban or similar solutions.

Look through your database and logs to find the average number of sign-up attempts from the same IP address, then double that and use it as the limit in fail2ban's configurations.

As for identifying the source of the requests, I'm not aware of any method that can reliably identify whence the request is coming. The attacker is always able to fake any request headers coming from the client (such as HTTP_X_REQUESTED_WITH or HTTP_REFERER), so don't rely on that.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.