https://yue-jenny.github.io/tags/rate-limiting/ Recent content in Rate Limiting on Jenny blog Hugo -- gohugo.io en-us Thu, 02 Feb 2023 10:55:49 +0800 https://yue-jenny.github.io/2023/02/%E7%B3%BB%E7%B5%B1%E8%A8%AD%E8%A8%88%E5%9F%BA%E7%A4%8E%E7%AD%86%E8%A8%98%E5%85%AD-rate-limiting/ Thu, 02 Feb 2023 10:55:49 +0800 https://yue-jenny.github.io/2023/02/%E7%B3%BB%E7%B5%B1%E8%A8%AD%E8%A8%88%E5%9F%BA%E7%A4%8E%E7%AD%86%E8%A8%98%E5%85%AD-rate-limiting/ <h2 id="rate-limiting">Rate Limiting</h2> <h3 id="prerequistites">Prerequistites</h3> <ul> <li>DDOS <ul> <li>分散式阻斷服務攻擊（distributed denial-of-service attack）亦稱洪水攻擊</li> </ul> </li> <li>DoS <ul> <li>阻斷服務攻擊（英語：denial-of-service attack）</li> <li>預防方式是使用 rate limit, 可以限制 IP, 使用者帳戶, 區域等等。</li> </ul> </li> </ul> <h3 id="rate-limiting-1">Rate Limiting</h3> <ul> <li>意思就是限流</li> <li>根據維基百科，定義是「控制計算機發送或接收的<strong>請求之頻率</strong>」</li> </ul> <h3 id="rate-limiting-for-multiple-server">Rate Limiting for Multiple Server</h3> <ul> <li>use <strong>Redis</strong> to implement rate limiting for multiple servers</li> </ul> <h2 id="application-layer-如何實現-rate-limit">Application Layer 如何實現 Rate Limit</h2> <ul> <li>實現方式 <ul> <li>在 Node.js 裡，有一個用來做限流的 express middleware 叫做 <a class="link" href="https://www.npmjs.com/package/express-rate-limit" target="_blank" rel="noopener" >express-rate-limit</a>，可<a class="link" href="https://ithelp.ithome.com.tw/m/articles/10268910" target="_blank" rel="noopener" >看這篇</a></li> </ul> </li> <li>缺點 <ul> <li>在 API server 裡面自己用 middleware 做限流，雖然這樣做感覺很方便，但也會讓 API server 無法完全專注在業務邏輯上</li> </ul> </li> </ul> <h2 id="aws-waf-web-application-firewall">AWS WAF (Web Application Firewall)</h2> <ul> <li>目的是保護您的 Web 應用程式免受常見 Web 入侵程式的危害</li> </ul> <h3 id="運作方式">運作方式</h3> <p><img src="https://yue-jenny.github.io/2023/02/%E7%B3%BB%E7%B5%B1%E8%A8%AD%E8%A8%88%E5%9F%BA%E7%A4%8E%E7%AD%86%E8%A8%98%E5%85%AD-rate-limiting/AWS-WAF.png" width="2360" height="699" srcset="https://yue-jenny.github.io/2023/02/%E7%B3%BB%E7%B5%B1%E8%A8%AD%E8%A8%88%E5%9F%BA%E7%A4%8E%E7%AD%86%E8%A8%98%E5%85%AD-rate-limiting/AWS-WAF_hu506d3f345407d576fe677b6871abeb83_162306_480x0_resize_box_3.png 480w, https://yue-jenny.github.io/2023/02/%E7%B3%BB%E7%B5%B1%E8%A8%AD%E8%A8%88%E5%9F%BA%E7%A4%8E%E7%AD%86%E8%A8%98%E5%85%AD-rate-limiting/AWS-WAF_hu506d3f345407d576fe677b6871abeb83_162306_1024x0_resize_box_3.png 1024w" loading="lazy" alt="source: https://docs.aws.amazon.com/waf/latest/developerguide/how-aws-waf-works.html" class="gallery-image" data-flex-grow="337" data-flex-basis="810px" ></p> <h4 id="關於-aws-waf-components">關於 AWS WAF components</h4> <ul> <li> <p><strong>Web ACLs</strong></p> <ul> <li>目的是保護 AWS resources，藉由建立一組 web ACL 並新增 rules 去定義保護策略</li> <li>屬於 AWS WAF resource</li> </ul> </li> <li> <p><strong>Rules</strong></p> <ul> <li>顧名思義，定義檢查標準 (inspection criteria)，當有 matching requests，可以做的事情如允許通過、計算他們或者執行 CAPTCHA puzzles 去檢查是否為機器人</li> <li><strong>不屬於</strong> AWS WAF resource</li> </ul> </li> <li> <p><strong>Rule groups</strong></p> <ul> <li>可以組合自己的 rule groups，也可以直接在 web ACL 中定義規則</li> <li>屬於 AWS WAF resource</li> </ul> </li> </ul> <h4 id="關於-web-acl-capacity-units-wcu">關於 Web ACL capacity units (WCU)</h4> <ul> <li>使用 <strong>WCU 來計算與控制運行規則、規則組和 Web ACL 所需的</strong>操作資源 <ul> <li>For example, a size constraint rule statement uses fewer WCUs than a statement that inspects against a regex pattern set.</li> </ul> </li> <li>AWS WAF 會管理 <strong>Rule capacity, Rule group capacity, Web ACL capacity</strong>，詳情可以參考<a class="link" href="https://docs.aws.amazon.com/waf/latest/developerguide/how-aws-waf-works.html" target="_blank" rel="noopener" >這篇</a></li> </ul> <h4 id="關於-resources-that-you-can-protect-with-aws-waf">關於 Resources that you can protect with AWS WAF</h4> <ul> <li>使用 AWS WAF web ACL 去保護<strong>全球或區域性</strong>的 resource types，只需要將 web ACL 連結到你想要保護的 resources 上，官方提供 <a class="link" href="https://docs.aws.amazon.com/waf/latest/developerguide/how-aws-waf-works.html" target="_blank" rel="noopener" >Amazon CloudFront 以及 Regional resources 特別說明</a> <ul> <li>Note: <a class="link" href="https://aws.amazon.com/tw/cloudfront/" target="_blank" rel="noopener" >Amazon CloudFront</a> 是一項<strong>內容交付網路(CDN)</strong> 服務，可協助您以高速效能、安全和開發人員易用性快速、可靠地分發靜態和動態內容。</li> </ul> </li> <li>限制 <ul> <li>一個 web ACL 可以連結多個 AWS resources，一個 AWS resource 僅連結一個 web ACL</li> <li>一個 web ACL 可以連結多個 CloudFront distributions，且已連結到 CloudFront distribution 的 web ACL <strong>不能</strong>再去連結其他 AWS resource type</li> </ul> </li> </ul> <h3 id="使用情境舉例-3-點">使用情境，舉例 3 點</h3> <ul> <li><a class="link" href="https://docs.aws.amazon.com/waf/latest/developerguide/waf-rules.html" target="_blank" rel="noopener" >篩選 Web 流量</a> <ul> <li>建立規則以根據各種條件篩選 Web 請求，例如 IP 地址、HTTP 標頭和內文，或自訂 URI。</li> </ul> </li> <li><a class="link" href="https://docs.aws.amazon.com/waf/latest/developerguide/waf-atp.html" target="_blank" rel="noopener" >防止帳戶接管詐騙</a> <ul> <li>監控應用程式的登入頁面，偵測以盜用憑證對使用者帳戶進行的未經授權存取。</li> </ul> </li> <li><a class="link" href="https://docs.aws.amazon.com/waf/latest/APIReference/Welcome.html" target="_blank" rel="noopener" >使用 API 管理 AWS WAF</a> <ul> <li>自動建立和維護規則，並將這些規則併入開發和設計程序中。</li> </ul> </li> </ul> <h3 id="比較-aws-waf-aws-shield-與-aws-firewall-manager">比較 AWS WAF, AWS Shield 與 AWS Firewall Manager</h3> <ul> <li><a class="link" href="https://docs.aws.amazon.com/waf/latest/developerguide/waf-chapter.html" target="_blank" rel="noopener" >AWS WAF</a> <ul> <li>monitor requests that are forwarded to your web applications and control access to your content.</li> </ul> </li> <li><a class="link" href="https://docs.aws.amazon.com/waf/latest/developerguide/shield-chapter.html" target="_blank" rel="noopener" >AWS Shield</a> <ul> <li>help protect against <strong>DDoS</strong> attacks.</li> </ul> </li> <li><a class="link" href="https://docs.aws.amazon.com/waf/latest/developerguide/fms-chapter.html" target="_blank" rel="noopener" >AWS Firewall Manager</a> <ul> <li>set up your firewall rules and apply the rules automatically across accounts and resources, even as new resources are added.</li> </ul> </li> </ul> <h2 id="參考資料-">參考資料 👐</h2> <ul> <li><a class="link" href="https://docs.aws.amazon.com/waf/latest/developerguide/what-is-aws-waf.html" target="_blank" rel="noopener" >What are AWS WAF, AWS Shield, and AWS Firewall Manager?</a></li> <li><a class="link" href="https://docs.aws.amazon.com/waf/latest/developerguide/how-aws-waf-works.html" target="_blank" rel="noopener" >How AWS WAF works</a></li> <li><a class="link" href="https://aws.amazon.com/tw/cloudfront/" target="_blank" rel="noopener" >低延遲內容交付網路 (CDN) - Amazon CloudFront - Amazon Web Services</a></li> <li><a class="link" href="https://www.npmjs.com/package/express-rate-limit" target="_blank" rel="noopener" >express-rate-limit</a></li> </ul> <p><strong>🍀 若喜歡我的分享，可以幫我拍拍手👏，是對我最大的鼓勵</strong></p>