DDoS Protection & Rate Limiting Abuse Cases

A DDoS (Distributed Denial of Service) attack overwhelms your system with fake traffic until real users can't get through. Defense is layered - no single solution works alone.

Types of Attacks

Defense in Depth (Layers)

Internet
│
▼
┌──────────────────────────────────┐
│  CDN / DDoS Scrubbing Center    │ ← Cloudflare, AWS Shield
│  Filters volumetric attacks     │   Absorbs Tbps-scale traffic
│  IP reputation, anycast routing │
└──────────────────┬───────────────┘
                   │ (clean traffic only)
                   ▼
┌──────────────────────────────────┐
│  WAF (Web Application Firewall) │ ← Cloudflare WAF, AWS WAF
│  Blocks SQLi, XSS, bad patterns │   Rate limits by IP/user-agent
│  OWASP Top 10 rules             │   Bot fingerprinting
└──────────────────┬───────────────┘
                   │
                   ▼
┌──────────────────────────────────┐
│  API Gateway / Load Balancer     │ ← Rate limiting per API key
│  Request throttling             │   IP allowlist/blocklist
│  Auth enforcement               │   Quota per user tier
└──────────────────┬───────────────┘
                   │
                   ▼
┌──────────────────────────────────┐
│  Application Rate Limiting       │ ← Redis-backed counters
│  Per-user, per-endpoint limits  │   Sliding window algorithm
│  CAPTCHA triggers               │   Business logic rules
└──────────────────┬───────────────┘
                   │
                   ▼
              Your Services

Rate Limiting Abuse Cases

1. Credential Stuffing Defense

// Stricter limits on auth endpoints
rateLimiter({
  "/api/login": {
    max: 5,
    window: "15min",
    by: "ip"
  },
  "/api/forgot-password": {
    max: 3,
    window: "1hr",
    by: "ip"
  },
  "/api/register": {
    max: 10,
    window: "1hr",
    by: "ip"
  },
});

• After 5 failures: require CAPTCHA
• After 10 failures: temp block IP for 1 hour
• Alert security team if 1000+ failures from IP range

2. API Abuse Tiers

• Free tier: 100 req/day, 10 req/min
• Pro tier: 10,000 req/day, 100 req/min
• Enterprise: Unlimited, custom limits

// Headers to return (industry standard):
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 42
X-RateLimit-Reset: 1699999999 (unix timestamp)
Retry-After: 60 (when limit hit, return 429)

3. Slow Loris Defense

Attacker sends HTTP headers very slowly to hold connections open.

# Nginx settings
client_body_timeout 10s;
client_header_timeout 10s;
keepalive_timeout 5s 5s;
send_timeout 10s;

Bot Detection Signals

Cloudflare Bot Management and reCAPTCHA v3 automate most of this.

AWS Shield Tiers

Most startups: Cloudflare Free or Pro tier is sufficient.

Pros

• CDN/scrubbing centers absorb traffic before it reaches you
• WAF handles OWASP Top 10 without code changes
• Rate limiting protects business logic and database
• Layered approach means no single point of failure

Cons

• Cloudflare/Shield costs money at scale
• Sophisticated L7 attacks (mimic real users) are hard to distinguish
• Blocking legitimate users with aggressive rate limits hurts UX
• Misconfigured WAF rules cause false positives

When to Use / When NOT to Use

Use when:

• Any public-facing API or website (DDoS is a real threat)
• Financial or health apps (credential stuffing target)
• APIs with expensive backend operations (LLM calls, DB writes)
• Any endpoint that is unauthenticated

Don't over-engineer when:

• Internal-only API (behind VPN/private network)
• Early prototype with 10 users - Cloudflare Free is enough
• Traffic is already behind authentication (harder to abuse)