Preventing denial of service attacks using rate limiting

A denial of service (DoS) attack is a malicious attempt to disrupt a web service by overwhelming it with requests. If the requests all came from the same place, for example, the same IP address, then it would be relatively easy to cut them off as soon as the attack is detected. But these attacks are often implemented as distributed DoS (DDoS) attacks from many locations so you cannot separate attackers from genuine clients.

A different approach is to apply rate limiting to everyone but let through more requests for genuine identified clients.

Genuine clients should only make the minimum requests they need. How many is reasonable will depend on your service. One way to prevent DDoS attacks would be to limit how many requests are allowed from any client per minute.

This technique is not just useful to prevent attacks. Even genuine clients might accidentally make too many requests, or for a commercial web service,...