Limiting servlet calls so they cannot be summoned by Curl programs like postman

[DanielMa63]

Greetings,

Recently we have had some issues with bad actors flooding our systems with calls in registration and rememberPass pages, the call we make for this processes to an external api goes through our java using servlets, and we were wondering, how can we stop flooding requests to our servlets through botting or other malicious means.

Filtering through domain does not seem very good since you can just fake that in the call.

Using cors does not seem ideal aswell since you can tamper with that header.

Maybe the cors header in dispatcher, some kind of check through the ResourceResolver?

We will appreciate any recommendation on how to deal with this issue

Best Regards,

Daniel

[Lokesh_Vajrala]

Hi @DanielMa63  

I believe adding the reCAPTCHA to the form would eliminate the spam and bot activity. You can also look at other alternatives - You can refer the documentation - https://experienceleague.adobe.com/en/docs/experience-manager-cloud-service/content/edge-delivery/bu... 

Thanks,

Lokesh

[MukeshYadav_]

Hi @DanielMa63 ,

Apart from captcha there can be WAF rules and ModSecurity ennoblement can help preventing flooding , DoS, DDoS, etc
https://experienceleague.adobe.com/en/docs/experience-manager-learn/cloud-service/security/traffic-f...

Thanks

[Jörg_Hoh · Accepted solution]

And in case of AEM CS you can also use the Traffic Rules to ratelimit and/or block such requests. Check the documentation on Traffic Rules at https://experienceleague.adobe.com/en/docs/experience-manager-cloud-service/content/security/traffic...