Understanding Web Security: Tokens, Rate Limiting, and Mitigation

Statutory Warning & Legal Disclaimer

This article is for educational and research purposes only. The techniques discussed here help developers, security engineers, and administrators understand common vulnerabilities so they can build stronger defenses. Under international cyber law, anyone conducting a penetration test must report discovered vulnerabilities to the relevant authorities immediately.

Part 1: Denial-of-Service (DoS/DDoS) Attack Vectors

A Denial-of-Service (DoS) or Distributed Denial-of-Service (DDoS) attack tries to exhaust system resources or network bandwidth, making an application unavailable to legitimate users. These attacks fall into three categories.

1. Volumetric Attacks

These consume available internet bandwidth:

UDP Floods: High volumes of UDP packets flood random ports. The target server inspects each packet for listening services and sends back ICMP destination unreachable responses, draining resources.
ICMP Floods: Rapid ping requests without waiting for responses saturate network throughput.
DNS Amplification: The attacker spoofs the target's IP and sends small queries to public DNS resolvers. The resolvers respond with much larger packets directed at the victim, amplifying the traffic.

2. Protocol Attacks

These target resource tables on firewalls, load balancers, or server connection queues:

SYN Floods: The attacker sends a flood of SYN packets but never returns the ACK. The server holds these connections half-open, exhausting its connection state table.
Smurf Attacks: The attacker spoofs the victim's IP and broadcasts ICMP packets. Every device on the broadcast domain replies to the victim, flooding it with traffic.

3. Application Layer Attacks

These target specific application features, such as database queries or login operations:

HTTP Floods: The server gets flooded with standard-looking HTTP GET/POST requests that force CPU-heavy operations like PDF generation or search queries.
Slowloris: The attacker opens many connections and keeps them open by sending partial HTTP headers very slowly, eventually filling the server's maximum connection pool.

Defensive Mitigations

Traffic Throttling: Deploy rate limiters at the load balancer or application gateway.
CDN Integration: Use CDNs with Anycast routing to distribute and absorb traffic spikes.
SYN Cookies: Enable SYN cookies on Linux hosts so memory is only allocated after the handshake completes.

Part 2: Token-Based Authentication Security

JSON Web Tokens (JWT) are widely used for stateless session management. Knowing how they work is essential for implementing them safely.

JWT Structure

A JWT consists of three base64-encoded segments separated by periods: header.payload.signature

Header: Specifies the token type and the hashing algorithm used (e.g., HMAC SHA-256).
Payload: Contains claims, such as user IDs, permissions, and expiry timestamps.
Signature: Generated by signing the encoded header and payload with a secret key.

Json

// Example Header
{
  "alg": "HS256",
  "typ": "JWT"
}

Common Authentication Vulnerabilities

Algorithm Confusion

If a JWT verification library is poorly configured, it may trust the algorithm field inside the token. An attacker can set the algorithm to "none" or sign an asymmetric RS256 token using the public key as an HMAC symmetric secret.

Remediation: Explicitly reject "none" algorithms in production. Hardcode the expected signature verification algorithm in your verification functions.

Weak Signature Secrets

HMAC-based tokens like HS256 rely on a shared secret key. If the key is short or simple, an attacker can brute-force it offline using GPU tools.

Remediation: Use cryptographically secure keys with at least 256 bits of entropy.

Insecure Client Storage

Storing tokens in localStorage makes them accessible to JavaScript, exposing them to theft through Cross-Site Scripting (XSS) attacks.

Remediation: Store tokens in secure, httpOnly cookies with SameSite=Strict and the Secure flag enabled. This prevents both XSS reading and CSRF abuse.

Part 3: Rate Limiting and Common Bypasses

Rate limiters protect servers from credential stuffing, brute-forcing, and scraping. Standard implementations, however, often contain logic errors that defeat their purpose.

Understanding DoS Attack Vectors: Autocannon and IPv6 Address Space Abuse

An educational deep dive into how high-performance HTTP tools like Autocannon combined with IPv6's massive address space create new distribu...

1. Trusted Proxy Header Spoofing

Many applications run behind a reverse proxy like Cloudflare, Nginx, or AWS ALB. The proxy forwards the client's real IP using headers like X-Forwarded-For or X-Real-IP. If the backend rate limiter trusts these headers without validating the source:

Vulnerability: An attacker appends arbitrary IP strings to the header:
Http
```
X-Forwarded-For: 203.0.113.195, 198.51.100.20
```
Remediation: Configure your backend to trust these headers only when the request comes from a designated local proxy subnet. Don't parse the header otherwise.

2. IPv6 Subnet Rotation

IPv4 addresses are limited, but IPv6 gives large subnets, typically a /64 or /48 allocation for a single household. Attackers can rotate through millions of individual IPv6 addresses.

Remediation: When applying rate limits to IPv6 traffic, aggregate requests and block at the /64 subnet level rather than matching individual IP addresses.

3. Fingerprinting & Behavioral Analysis

Rate limiting by IP alone is vulnerable to distributed botnets.

Remediation: Implement multi-factor rate limiting. Track request frequency against user session keys, API tokens, and client TLS/JA3 fingerprints. Introduce CAPTCHA challenges when request behavior deviates from normal usage profiles.

Python

# Conceptual Rate Limiter Checks
def check_rate_limit(request):
    keys = [
        get_validated_client_ip(request),
        get_user_session_token(request),
        get_api_key(request)
    ]

    for key in keys:
        if key and is_limit_exceeded(key):
            return 429_TOO_MANY_REQUESTS

    record_request(keys)
    return PROCEED

Deep Dive: Advanced Security Vulnerabilities

Advanced Security Vulnerabilities: Deep Dive Analysis

An educational deep dive into advanced web security vulnerabilities, analyzing attack mechanisms, protocol smuggling, and mitigation strateg...

Conclusion

Securing web applications requires multiple layers of defense. Strong input sanitization, secure signature validation, and multi-factor rate limiting work together to protect backend services from both volumetric and application-level abuse.

Understanding Web Security: Tokens, Rate Limiting, and Mitigation

Statutory Warning & Legal Disclaimer

Part 1: Denial-of-Service (DoS/DDoS) Attack Vectors

1. Volumetric Attacks

2. Protocol Attacks

3. Application Layer Attacks

Defensive Mitigations

Part 2: Token-Based Authentication Security

JWT Structure

Common Authentication Vulnerabilities

Algorithm Confusion

Weak Signature Secrets

Insecure Client Storage

Part 3: Rate Limiting and Common Bypasses

Understanding DoS Attack Vectors: Autocannon and IPv6 Address Space Abuse

1. Trusted Proxy Header Spoofing

2. IPv6 Subnet Rotation

3. Fingerprinting & Behavioral Analysis

Advanced Security Vulnerabilities: Deep Dive Analysis

Conclusion

Read Also

Understanding IPv6 Address Space Abuse, Programmatic rotation and Prevention

Understanding DoS Attack Vectors: Autocannon and IPv6 Address Space Abuse