Preventing DDoS Attacks in .NET Core APIs 🚨

Distributed Denial of Service (DDoS) attacks are a growing concern for web applications, including APIs. These attacks overwhelm your server by sending massive amounts of fake traffic, causing service disruptions for legitimate users. If you're building APIs with .NET Core, it's crucial to understand how to protect your services.

In this blog, we'll explore how DDoS attacks work, prevention strategies, and practical solutions to secure your .NET Core API from such attacks. Let's dive in! 🛡️

---

What is a DDoS Attack? 🤔

A DDoS attack is a type of cyberattack where multiple sources flood a target system with fake traffic, exhausting its resources and rendering it unavailable to legitimate users. Unlike regular Denial of Service (DoS) attacks, DDoS attacks involve multiple machines, often part of a botnet.

Key Characteristics:

• Volumetric Attacks: Overwhelming bandwidth or server capacity.
• Application Layer Attacks: Targeting specific application endpoints to overload them.
• Connection Depletion: Exhausting connections by opening and never closing them.

---

Symptoms of a DDoS Attack 🚨

• Sudden spikes in traffic that your application cannot handle.
• Increased latency or server timeouts.
• Unavailability of certain endpoints or the entire API.

---

How to Mitigate DDoS Attacks in .NET Core APIs

Here are some best practices and techniques for defending your .NET Core API against DDoS attacks.

---

1. Rate Limiting ⏳

Rate limiting restricts the number of requests a client can make within a specific time window. This helps prevent malicious users or bots from overwhelming your API.

Example: Implementing Rate Limiting in .NET Core

Install the AspNetCoreRateLimit NuGet package:

dotnet add package AspNetCoreRateLimit

Update your appsettings.json:

"IpRateLimiting": {
  "EnableEndpointRateLimiting": true,
  "StackBlockedRequests": false,
  "RealIpHeader": "X-Real-IP",
  "ClientIdHeader": "X-ClientId",
  "HttpStatusCode": 429,
  "GeneralRules": [
    {
      "Endpoint": "*",
      "Period": "1s",
      "Limit": 5
    },
    {
      "Endpoint": "api/values",
      "Period": "1m",
      "Limit": 100
    }
  ]
}

Configure the middleware in Program.cs:

builder.Services.AddMemoryCache();
builder.Services.Configure<IpRateLimitOptions>(builder.Configuration.GetSection("IpRateLimiting"));
builder.Services.AddInMemoryRateLimiting();
builder.Services.AddSingleton<IRateLimitConfiguration, RateLimitConfiguration>();

var app = builder.Build();
app.UseIpRateLimiting();
app.Run();

This limits API calls and protects your server from overload.

---

2. Throttling 📉

Throttling limits concurrent requests to your API. Unlike rate limiting, which focuses on the number of requests over time, throttling prevents an excessive number of simultaneous requests.

Example: Adding Throttling Middleware

Create a custom middleware for throttling:

public class ThrottlingMiddleware
{
    private static readonly SemaphoreSlim Semaphore = new SemaphoreSlim(10); // Allow 10 concurrent requests

    private readonly RequestDelegate _next;

    public ThrottlingMiddleware(RequestDelegate next)
    {
        _next = next;
    }

    public async Task InvokeAsync(HttpContext context)
    {
        if (!Semaphore.Wait(0))
        {
            context.Response.StatusCode = 429; // Too Many Requests
            await context.Response.WriteAsync("Too many concurrent requests.");
            return;
        }

        try
        {
            await _next(context);
        }
        finally
        {
            Semaphore.Release();
        }
    }
}

Register the middleware:

app.UseMiddleware<ThrottlingMiddleware>();

---

3. IP Blocking 🔒

Identify and block suspicious IP addresses that generate a high volume of requests. Use middleware or external services to block these IPs dynamically.

Example: Block Specific IPs

Update appsettings.json:

"BlockedIPs": [
  "192.168.1.100",
  "203.0.113.0"
]

Create middleware to block these IPs:

public class IpBlockingMiddleware
{
    private readonly RequestDelegate _next;
    private readonly HashSet<string> _blockedIPs;

    public IpBlockingMiddleware(RequestDelegate next, IConfiguration configuration)
    {
        _next = next;
        _blockedIPs = new HashSet<string>(configuration.GetSection("BlockedIPs").Get<string[]>());
    }

    public async Task InvokeAsync(HttpContext context)
    {
        var ipAddress = context.Connection.RemoteIpAddress?.ToString();

        if (_blockedIPs.Contains(ipAddress))
        {
            context.Response.StatusCode = 403; // Forbidden
            await context.Response.WriteAsync("Your IP has been blocked.");
            return;
        }

        await _next(context);
    }
}

Register the middleware:

app.UseMiddleware<IpBlockingMiddleware>();

---

4. Using a Web Application Firewall (WAF) 🔥

A WAF filters and monitors HTTP traffic to protect against malicious attacks, including DDoS. Tools like Azure WAF or AWS WAF can help you manage traffic before it even hits your server.

Example: Enabling Azure WAF

1. Go to your Azure Portal.
2. Navigate to the Application Gateway.
3. Enable the Web Application Firewall feature.
4. Configure rules to detect and mitigate malicious requests.

---

5. Caching Responses 🧑‍💻

Reduce server load by caching frequently accessed endpoints. Cached responses reduce the need to process every request individually.

Example: Response Caching in .NET Core

Enable response caching in Program.cs:

builder.Services.AddResponseCaching();

var app = builder.Build();
app.UseResponseCaching();

app.MapGet("/api/values", () =>
{
    return Results.Ok(new { Value = "Cached Response" });
}).WithMetadata(new ResponseCacheAttribute
{
    Duration = 60,
    Location = ResponseCacheLocation.Client
});

app.Run();

---

6. Scaling with Load Balancers ⚙️

Use horizontal scaling and load balancers to distribute traffic across multiple servers. Services like Azure Load Balancer or AWS ELB can help manage high traffic efficiently.

---

Monitoring and Logging 🛠️

It’s essential to monitor your application for suspicious activity. Tools like Application Insights, ELK Stack, or Prometheus can help.

Example: Using Application Insights

Enable Application Insights in your .NET Core API:

dotnet add package Microsoft.ApplicationInsights.AspNetCore

Add the service in Program.cs:

builder.Services.AddApplicationInsightsTelemetry();

Monitor traffic patterns and detect anomalies in the Azure portal.

---

Wrapping It Up 🎉

DDoS attacks are a real threat, but with proper planning and the tools available in .NET Core, you can protect your APIs effectively. From rate limiting and throttling to caching and WAF integration, these techniques can mitigate attacks and keep your API running smoothly.

Start implementing these defenses today, and let your .NET Core API shine under heavy traffic—legitimate traffic, that is. 😊 Happy coding! 🚀