Backend DoS Protection — Defending Against Denial of Service Attacks

// Connection and request limits
const http = require('http');

const server = http.createServer(app);

server.maxConnections = 1000;
server.timeout = 30000;
server.keepAliveTimeout = 5000;
server.headersTimeout = 60000;

// Request size limits
app.use(express.json({ limit: '1mb' }));
app.use(express.urlencoded({ limit: '1mb', extended: true }));

app.use('/api/upload', express.raw({
  limit: '50mb',
  type: 'application/octet-stream'
}));

// Concurrent request limiter
class ConcurrencyLimiter {
  constructor(maxConcurrent = 50) {
    this.maxConcurrent = maxConcurrent;
    this.current = 0;
    this.queue = [];
  }

  async acquire(req, res, next) {
    if (this.current >= this.maxConcurrent) {
      return res.status(503).json({
        error: 'SERVICE_BUSY',
        message: 'Server at capacity, please retry later',
        retryAfter: 5
      });
    }

    this.current++;
    res.on('finish', () => this.current--);
    next();
  }
}

// Slow loris protection
const slowloris = require('slowloris');
app.use(slowloris({
  threshold: 5000,  // 5 second threshold
  interval: 1000
}));

// Request timeouts by endpoint
app.post('/api/scans', timeout(30000), scanHandler);
app.get('/api/scans', timeout(10000), listHandler);

// CDN/WAF rules (Cloudflare example)
// Rate limiting rule:
// requests: 1000, time: 60 seconds, action: block
// 
// Security level:
// Challenge threshold: medium