IConfiguration vs IOptions NET
Synchronous and Asynchronous in .NET Core
Model Binding and Validation in ASP.NET Core
ControllerBase vs Controller in ASP.NET Core
ConfigureServices and Configure methods
IHostedService interface in .NET Core
ASP.NET Core request processing
 | IActionResult vs ActionResult | Middleware in ASP.NET Core |  |
DDoS (distributed denial-of-service) Attack |
A distributed denial-of-service (DDoS) attack is a malicious attempt to disrupt the normal traffic of a website, server, or network by overwhelming it with a flood of internet traffic. The "distributed" nature of these attacks means the traffic comes from multiple sources, making them harder to stop by simply blocking a single source.
The attack works by consuming the target's resources, resulting in poor performance, or completely shutting it down. DDoS attacks are illegal and can cause significant financial losses, reputational damage, and operational disruption for the targeted organization.
A DDoS attack is carried out using a "botnet," a network of internet-connected devices (like computers, phones, and IoT devices) that have been infected with malware.
Attackers identify a target, such as a website, and then generate a massive amount of malicious traffic aimed at exhausting its resources.
This traffic usually comes from a botnet, which is a network of compromised devices (like smartphones, PCs, or IoT devices) that have been infected with malware.
The sheer volume of incoming traffic overwhelms the target's server or network, making it slow or completely unresponsive to legitimate users.
Websites and online services can become inaccessible, leading to lost sales and productivity.
A prolonged or frequent DDoS attack can erode customer trust and damage a company's brand.
Organizations may incur significant costs from responding to the attack, such as hiring security experts and upgrading their network infrastructure.
Participating in DDoS attacks constitutes a cybercrime and may lead to severe legal consequences, including the seizure of electronic devices, under the laws of numerous countries worldwide.
Enforcement agencies such as the FBI, Europol, and national cybercrime units actively investigate and prosecute individuals involved in DDoS activities.
DDoS attacks can be categorized by which component of the network they target:
These are the most common and simple type of DDoS attack. They flood the network with a high volume of traffic to consume all available bandwidth.
These attacks exploit vulnerabilities in network protocols (like TCP or ICMP) to consume server resources and network equipment like firewalls.
These attacks target specific applications or services at Layer 7 of the OSI model, overwhelming them with seemingly legitimate but resource-intensive requests.
While it's impossible to prevent all DDoS attacks, a multi-layered defense strategy can significantly reduce the risk and impact.
One effective way to mitigate DDoS at the application level is by using the built-in RateLimiter middleware in .NET Core 7+. This limits the number of requests per user or IP within a time window.
Program.cs, configure the global rate limiter.
// Program.cs
builder.Services.AddRateLimiter(options =>
{
options.GlobalLimiter = PartitionedRateLimiter.Create(httpContext =>
RateLimitPartition.GetFixedWindowLimiter(
partitionKey: httpContext.Connection.RemoteIpAddress?.ToString() ?? "anonymous",
factory: partition => new FixedWindowRateLimiterOptions
{
PermitLimit = 20,
Window = TimeSpan.FromMinutes(1),
QueueLimit = 0,
AutoReplenishment = true
}));
});
var app = builder.Build();
app.UseHttpsRedirection();
app.UseAuthorization();
app.UseRateLimiter(); // Apply rate limiting
app.MapControllers();
app.Run();
Apache JMeter or wrk to simulate traffic.429 Too Many Requests.| Pros | Cons |
|---|---|
| Simple to implement in .NET Core | Limited to application-level protection |
| Customizable per user/IP | Does not protect against volumetric attacks |
| Works well with APIs and microservices | Requires .NET 7+ for built-in support |
| | IActionResult vs ActionResult | Middleware in ASP.NET Core | |