I am new to the IT Security field and am essentially a developer as opposed to a networking person hence the question may be a dumb one
I am writing a REST service exposed to the internet which accepts files to be uploaded to the server, and the size could be up to 5 MB. We have restrictions on the server side to not accept content greater than 5 MB, but this happens after the fact - meaning after the content has been uploaded and we are already reading it. Which raises a few security related questions on DDOSing of our service:
- What happens if a bot net starts uploading 100MB files from 100 machines at the same time. This would mean that our network pipes are clogged handling 10GB of data while slowing down our real customers? How do we even detect such an attack where the number of servers are so less. Can we configure our IT infrastructure to block requests by payload size based on the service being accessed (we have multiple services hosted in our IT infrastructures)?
- Can you turn back requests from your IT infrastructure whose content length goes beyond a certain limit?
- In general, for a server which accepts POST/PUT requests, how do you protect from an attack which just uploads files on the POST request, even though the server is not meant to accept file uploads?