Preventing denial-of-service attacks using rate limiting

A denial-of-service (DoS) attack is a malicious attempt to disrupt a web service by overwhelming it with requests. If the requests all came from the same place, it would be relatively easy to cut them off as soon as the attack is detected. These attacks are often implemented as distributed DoS (DDoS) attacks from many locations so you cannot separate attackers from genuine clients.

Genuine clients should only make the minimum requests they need. How many is reasonable will depend on your service. One way to prevent DDoS attacks would be to limit how many requests are allowed from any client per minute. This technique is not just useful to prevent attacks. Even genuine clients might accidentally make too many requests, or for a commercial web service you might want to charge different amounts for different rates, like when controlling a subscription.

When a client makes requests over a set rate limit, the client should...