How to protect your API?
Have you deployed your Websites or Mobile Apps and got hit in the face with thousands of dollar worth of bills from your SMS provider after a few months? I have. Today I’m going to share how to protect your API especially that might cost you a lot of money such as SMS OTP, Email sending API, File Upload API, etc. I’m going to talk only about “Rate Limiting” in this article while there are so many things you can do to protect your API such as preventing SQL injection, using a queue system to delay processing, etc.
Here are the steps you can take to prevent your API from attacks using rate limiting, especially from DDOS.
Rate Limiting
Rate limiting can improve your API performance as well as save you money. Here’re 4 ways you can rate limit sort by the strictness of it.
1. Request per second/minute/hour
This is the easiest and the most basic way of implementing rate limits but also the easiest to bypass. Depending on your application, you can think of a rate to limit. Very useful for API that has read/write heavy to your Database. You can use CDN such as Cloudflare to easily add such rate limiting.
2. Rate limit by IP
This is a stricter version of rate limiting, the limit is based on the IP of the user. For example, only allow 30 requests per minute from a single IP. This is very similar to Number 1 but stricter. This is harder for attackers to bypass but is still possible by using a proxy server. You can implement this using pretty much all the CDN.
3. Adding CAPTCHA
Adding a CAPTCHA is especially useful when your API call cost money, such as OTP, Email notification. The most common CAPTCHA is Google reCAPTCHA. By integrating with reCAPTCHA, google will try to verify if your client is valid so your Mobile Apps or Web Frontend will have to do the integration too. This way it’s harder for attackers to call the API without rendering your frontend properly, eliminating most of the DOS attack. This will take a little bit more time to implement but well worth it.
4. Rate limit based on Unique Identifier (ID, Email, Phone)
An example of this is, only allowing users to request OTP 3 times a day. This is the strictest rate-limiting strategy and you wouldn’t need it unless you are working for a really big company where your API users are making your API call multiple times a second such as Stock/Crypto Exchange. You probably wouldn’t need to read this article if you are working for such a company :).
Feel free to reach out if you have any questions!
