3

After Login, severs can check authorization, tokens etc at API and WAF levels to mitigate DDoS attacks. But this can only happen after user has logged in. How can we protect DDoS attack on login API? I guess we can use ip address as one of the hint to detect attack, but what are other options available? Thanks!

Improve this question

2 Answers 2

Reset to default
4

I second @RaimondsLiepiņš; don't try to solve DDoS yourself, buy protection through your CDN.

At its core, a DDoS attack comes down to whether the attacker has a bigger firehose than you do; if they can use a botnet to generate more requests-per-second than your server can handle, then they win.

CDNs have invested in AI, monitoring, security teams, etc to detect sudden spikes of traffic and respond to them in real-time using a variety of tricks to filter legitimate traffic from bot-generated traffic. I totally recommend paying your CDN for DDoS protection rather than trying to invent it yourself.

Improve this answer
4
  • 1
    Mike and Raimonds, Thanks for your suggestions. I understand using CDN DDoS protection is a better way to mitigate. But from academic perspective, I wish to understand how authentication API can be protected from DDoS attacks. I do know few techniques post authentication, but without any user data how a resource can be protected must be extremely tricky.
    – Vijayendra
    Commented Oct 9, 2019 at 14:16
  • @Vijayendra Correct, very tricky. You need some sort of artificial intelligence to try to detect which login requests are legitimate, and which are part of an attack. fail2ban is software you can install on your server that does an ok job at this. In general though, CDNs are in a better position to do this because they can analyze traffic across their entire network looking for suspicious patterns, whereas you can only see traffic at your server.
    – Mike Ounsworth
    Commented Oct 9, 2019 at 14:30
  • Anti-DDoS is a hard problem. Don't expect good results unless you have a team of humans watching realtime traffic analysis on monitors and reacting.
    – Mike Ounsworth
    Commented Oct 9, 2019 at 17:54
  • 1
    @Vijayendra DDoS is not a very academic thing. It's essentially just "lots of people wanting stuff from you", and the only way to answer this is to have more ressources than the attacker. It's a simple "might is right" scenario and nothing more.
    – user163495
    Commented Oct 13, 2019 at 13:35
3

Just use a CDN to deliver the webiste, that will be the best protection against a Distributed DOS attack.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .