Preventing DoS in Ajax Calls

Question

We have Ajax call to validate the UserID on create page so that user there only can know if their chosen ID is available or not.

We have this URL exposed : https://mydomain.com/validateId?id=<user enter value>

Lately some hackers are sending large amount of concurrent requests to this URL and we are observing very high load on CPU's even to 100%

We don’t have any session identifiers available in the action for that Ajax calls. What technique can we use to prevent so many direct concurrent calls? Any way to identify if the users are firing these Ajax calls from the create pages and not directly using some malicious tools?

Answer 1

It looks like you're being targeted by a determined attacker, so you should immediately start by implementing rate-limiting measures. I highly recommend using fail2ban or similar solutions.

Look through your database and logs to find the average number of sign-up attempts from the same IP address, then double that and use it as the limit in fail2ban's configurations.

As for identifying the source of the requests, I'm not aware of any method that can reliably identify whence the request is coming. The attacker is always able to fake any request headers coming from the client (such as HTTP_X_REQUESTED_WITH or HTTP_REFERER), so don't rely on that.