I'm using Drupal Services along with Drupal Commerce Services to make an e-commerce site that runs on JS/Backbone.

I want to prevent a user from being able to flood an API endpoint with requests, because in my initial tests it seems that hitting a few endpoints every 100ms kills my Mariadb process after about half a minute. Although I think it's actually the massive increase in PHP-FPM that does it. Either way, I'm looking for a Drupal-first route, so it will be solid on the server, client and api.

I'm not looking for anything regarding hiding the submit button or anything like that, I'd rather something that would "lock" any JSON requests if, say, 5 requests are made in 10 seconds, based on IP, sessionID and others. Similar to what fail2ban or the NPM flood module does.

It may be a basic module tat I've just not found yet, so apologies if the answer should be obvious.

  • I think you may search how to make increase performance for the mariadb server. – Mohammed Gomma Nov 23 '15 at 10:55
  • @Mhmdgomma Mariadb isn't the issue, it's more that the server doesn't have enough RAM to fulfil the amount of php-fpm requests and when MDB runs out of memory, it dies. I have put a rate limiter on with nginx, but I wanted to know if I could also prevent flooding (like droop's native user login IP flooding) on service requests. – Matt Fletcher Nov 23 '15 at 13:56
  • I think the best solution will be outside php itself before the request being served by php-fpm try tools or setting for apache itself – Mohammed Gomma Nov 23 '15 at 14:14
  • I appreciate you taking the time to comment, so thanks- but as I just mentioned I'm using nginx not apache, and I already have set up a rate limiter on the server. I'm asking if there's a Drupal way too as I'd like to be able to block it in more ways than just via the server. – Matt Fletcher Nov 23 '15 at 14:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.