I have designed a backend service which is only accessible via a custom REST API. As I understand, services such as CloudFlare are designed to protect HTTPS traffic, and do not apply for custom APIs.

How can I protect my API against DDoS attacks? What services, tools and design considerations should I bear in mind to protect my API service from DDoS attacks?


I'd suggest to hide your REST API behind a so-called API Gateway. Such components should handle that.

I know that APIGee provides different features (http://docs.apigee.com/api-services/content/comparing-quota-spike-arrest-and-concurrent-rate-limit-policies) that can help to mitigate DDoS attacks.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.