Search code examples
apacheresthttpservletswebserver

What's the correct HTTP response code to return for Denial of Service (DoS) attack?

I have some logic in the web server to find out if the user is trying to do a DoS attack. But what's the correct HTTP response code to return for that? Also what's a good error message I can put in HTTP body to tell the user politely that he's got into the DoS attack path?

Solution

  • But what's the correct HTTP response code to return for that?

    RFC 6585 suggests 429 Too Many Requests

    The 429 status code indicates that the user has sent too many requests in a given amount of time ("rate limiting").

    If the attack has compromised your ability to handle legitimate requests, then to those you might respond with 503 Service Unavailable.

    Note the change in semantics - the person sending the bad requests gets a status from the 4xx Client Error class, while those not at fault get a status from the 5xx Internal Service Error class.

    what's a good error message I can put in HTTP body to tell the user politely that he's got into the DoS attack path?

    Please stop that?