After Login, severs can check authorization, tokens etc at API and WAF levels to mitigate DDoS attacks. But this can only happen after user has logged in. How can we protect DDoS attack on login API? I guess we can use ip address as one of the hint to detect attack, but what are other options available? Thanks!
I second @RaimondsLiepiņš; don't try to solve DDoS yourself, buy protection through your CDN.
At its core, a DDoS attack comes down to whether the attacker has a bigger firehose than you do; if they can use a botnet to generate more requests-per-second than your server can handle, then they win.
CDNs have invested in AI, monitoring, security teams, etc to detect sudden spikes of traffic and respond to them in real-time using a variety of tricks to filter legitimate traffic from bot-generated traffic. I totally recommend paying your CDN for DDoS protection rather than trying to invent it yourself.