Recently we had a discussion about the security of a mobile app we are working on. The security team requested that if a user is blocked (due to many failed login attempts), then the back-end should return the date/time the block will be lifted, so that the mobile app will internally block all outgoing API calls until that date/time.
The reason quoted is that a user or a large number of users could attempt to do a 'fake login' to perform some sort of DDoS attack, and a way to stop that attack would be to make the app block these attempts if the user is blocked.
Does this make any sense? I can't find any arguments with or against this logic. but i personally don't see the benefit because a DDoS attack requires a very large number of requests per second.
'so that the mobile app will internally block all outgoing API calls until that date/time'
- if an attacker is going to try to DDOS your API endpoint, they are not going to use your app to do it. They are going to use a rented botnet, or something similar.