WHDB API Throttling

Review
API Throttling - Options
Rate limiting – WAF
• Meant to protect DDos attacks.
• Can monitor each requests by IP,
and in a 5mins, the IP crosses the
rate it blocks further call for that IP.
• Unblocking the IP depends on the
configurations
• Contacting Dev
• Setting the cooldown period,
for automatic unblock.
Throttling with API Gateway At application – ASP.NET MVC
• Can protect from DDos attack. • Caches the IP from each request.
• Can set the rate limits per second. • When the request reaches the limit,
• Can set the burst limits pre second. returns 429
• Upon crossing the limit, Users gets
HTTP-429 responds (too many
requests).
• No blocking / unblocking IPs.
• Timeouts are hard limit to 30s. But
we need 60s.
API Throttling – ASP.NET MVC
Possibility Problems
Using ActionFilterAttribute, intern uses HttpRuntime.Cache. • The Http cache is dependency that might not be available with new runtimes, like self-hosted options. It is
best to avoid this dependency.
Requirement:
Enable throttling by configuration. For example: On-prem • The Filter is being processed 'too late in the game' within web API pipeline, so lots of resources are being
deployment will not required throttle. spent before you decide that request should not be processed. The DelegatingHandler should be used
because it can be set to run at the beginning of the Web API pipeline and cutting off the request prior doing
any additional work.

Ref:
https://stackoverflow.com/questions/20817300/how-to-throttle-requests-in-a-web-api

Solution
Use Opensource https://github.com/stefanprodan/WebApiThrottle , also available as NuGet, under MIT.
• Highly configurable and customizable. And easy to use.
• Option to switch cache provider based on environment.
• 1.2k stars on GitHub.
• Much recommended for throttling using ASP.NET. Also available in .NET Core.
API Throttling – API Gateway
Current Change

Regional WAF for API

Gateway
Global WAF for
CloudFront

Security Group - Inbound:

Security Group - Inbound: Allows all CloudFront Ips
Allows all CloudFront Ips
HTTP_PROXY

{stage}.dashboard.{URL} {stage}.alb.{URL} Load Balancer

{stage}.dashboard.{URL} {stage}.alb.{URL} Load Balancer A record Throttling: origin
A record origin Rate: 100
Brust: 50
Block access using
Custom
*.cloudfront.net
Domain - edge.

Changes
• Changes at deploy / cloudformation has been done.
• Refer dev24 environment which goes through API Gateway with throttling applied.
PENDING:
• Addressing backward compatibility for WAF, at script.
• Blocking access using *.cloudfront.net at WAF level.
API Throttling – WAF

Global WAF for

CloudFront

With Rate based rule

Security Group - Inbound:

Allows all CloudFront Ips

{stage}.alb.{URL} Load Balancer

origin

Required Changes
• CloudFormation to create Rate based rule.
• Script to attach the rule to the WAF. As there is no way for now to attach rate-based rule to WAF.
Ref: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-wafregional-ratebasedrule.html