Tomato and flood protection

Question

We use Tomcat 7 for our web application. We provide an XML-based API so that our customers can communicate with our server in machine-to-machine mode (without the need for a web browser). Requests are processed by the servlet.

We need to prevent users from sending too many requests in a row. Some of the services we provide include polling results, and users can make queries in a loop without any breaks, making dozens of queries per second for nothing.

How can we protect ourselves from flooding with useless requests? Is there an easy way to block requests at the servlet input level when there are too many requests coming from the same IP address? Is there anything built-in Tomcat to solve this problem?

Answer 1

Assuming you are using a reverse apache proxy before tomcat (if it shouldn't), use mod_cband in the apache layer.

Answer 2

You can write your own.

The starting points for this issue will be the servlet API, in particular the filter interface and the getRemoteHost () method of the SerlvetRequest interface.

It should be easy enough to write a filter implementation that stores the number of requests from each host and takes action if the limit is exceeded.

Answer 3

Spring There are many Apache httpd mod_security features in the security system if you want to use only a Java solution.

Answer 4

Apache mod_evasive or mod_security can cover your need here. You can consider Cloudflare for more complex, serious attacks that require hardware protection.