CODEWITHSUNDEEP
javaweb-servicestomcatweb-applicationsservlets
J. Volkya
J. Volkya

Reputation: 1000

Tomcat and flood protection

We are using Tomcat 7 for our web application. We provide an XML based API so that our customers can communicate with our server in a machine-to-machine way (no web browser needed). The requests are processed by a servlet.

We need to prevent users from sending too many requests in a row. Some of the services we provide involve polling for results and users may make requests in a loop without any pauses, making dozens of requests per second for nothing.

How can we protect ourselves from being flooded with useless requests? Is there a simple way to block requests at the servlet entry level when there are too many requests originating from the same IP? Is there something built-in Tomcat to deal with this problem?

Upvotes: 6

Views: 1270

Answers (4)

Olofu Mark
Olofu Mark

Reputation: 1040

Apache's mod_evasive or mod_security could cover for your need here. You may consider Cloudflare for more complexly serious attacks that will require hardware protection.

Upvotes: 0

Christopher Schultz
Christopher Schultz

Reputation: 20862

Spring Security has a lot of the features of Apache httpd's mod_security if you want a Java-only solution.

Upvotes: 0

Alan Hay
Alan Hay

Reputation: 23246

You could code your own.

Starting points for looking at this would be the Servlet API, in particular the Filter interface and the getRemoteHost() method of the SerlvetRequest interface.

Should be easy enough to write a Filter implementation which stores a count of requests from each host and takes action if a limit exceeded.

Upvotes: 2

Rocky Pulley
Rocky Pulley

Reputation: 23311

Assuming that you are using an apache reverse-proxy in front of tomcat (if you aren't you should be), use mod_cband on the apache layer.

Upvotes: 4

Related Questions