3 ms·

I had similar issue for one of our clients. My strategy to not affect legit users was to enable mitigations if global traffic crossed some threshold. eg. in yo

I had similar issue for one of our clients. My strategy to not affect legit users was to enable mitigations if global traffic crossed some threshold. eg. in your case this could mean if traffic is above eg. 75QPS then captcha is enabled, and if it's below that it's disabled. I don't know what tech stack you are using, but nice trick that i figured out was to abuse rate limiting to detect global traffic (doing if branch with rate limit with const as client id)

pfooti 3y ago
That is more or less what I landed on myself. (Not quite, but similar reactive configs based on traffic thresholds). For a while, we had to just set off pagers when global traffic exceeded a threshold and manually toggle the extra hardening, but eventually it became a lot more reactive.