DDoS #

// Slowloris example — one machine can make a server unresponsive
// Attackers send HTTP headers slowly, never completing the request

// Conceptual simulation (don't use for attacks):
// import "net"
// sockets := make([]net.Conn, 0, 200)
// for i := 0; i < 200; i++ {
//     s, _ := net.Dial("tcp", target+":80")
//     s.Write([]byte("GET / HTTP/1.1\r\n"))
//     s.Write([]byte("Host: target.com\r\n"))
//     sockets = append(sockets, s)
// }
//
// for {
//     for _, s := range sockets {
//         s.Write([]byte("X-a: b\r\n")) // send headers one by one, very slowly
//     }
//     time.Sleep(15 * time.Second)
// }

// The server keeps these connections open because the headers aren't complete
// 200 connections can take down an Apache server with a small MaxClients

// Slowloris mitigations:
// → Nginx is more resilient than Apache (event-driven, not thread-per-connection)
// → Strict request timeouts
// → Per-IP connection limits

// Layered rate limiting implementation with Redis

// redisClient is a go-redis client (import "github.com/redis/go-redis/v9")
var redisClient = redis.NewClient(&redis.Options{Addr: "redis:6379"})
var ctx = context.Background()

// RateLimiter uses the sliding window algorithm.
// More accurate than fixed windows — no spikes at window boundaries.
type RateLimiter struct {
	Redis         *redis.Client
	MaxRequests   int
	WindowSeconds int
}

type RateLimitResult struct {
	Allowed   bool
	Remaining int
	ResetAt   int64
}

func (rl *RateLimiter) IsAllowed(identifier string) RateLimitResult {
	now := time.Now().Unix()
	key := "rate:" + identifier

	// Remove entries outside the window, count, add, set expiry — one pipeline
	pipe := rl.Redis.TxPipeline()
	pipe.ZRemRangeByScore(ctx, key, "0", strconv.FormatInt(now-int64(rl.WindowSeconds), 10))
	card := pipe.ZCard(ctx, key)
	pipe.ZAdd(ctx, key, redis.Z{Score: float64(now), Member: now})
	pipe.Expire(ctx, key, time.Duration(rl.WindowSeconds)*time.Second)
	_, _ = pipe.Exec(ctx)

	currentCount := int(card.Val())
	return RateLimitResult{
		Allowed:   currentCount < rl.MaxRequests,
		Remaining: max(0, rl.MaxRequests-currentCount-1),
		ResetAt:   now + int64(rl.WindowSeconds),
	}
}

// Several limiters with different thresholds for different endpoints
// Global: all endpoints
var globalLimiter = &RateLimiter{Redis: redisClient, MaxRequests: 1000, WindowSeconds: 60}

// Sensitive API endpoints: stricter
var apiLimiter = &RateLimiter{Redis: redisClient, MaxRequests: 100, WindowSeconds: 60}

// Auth endpoints: very strict to prevent brute force
var authLimiter = &RateLimiter{Redis: redisClient, MaxRequests: 10, WindowSeconds: 300}

// Wrapper replacing the Python decorator.
// identifierFunc resolves the client identifier (IP, user, or a combination).
func rateLimit(limiter *RateLimiter, identifierFunc func() string, handler http.HandlerFunc) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		// Identifier: per IP, per user, or a combination
		identifier := r.RemoteAddr
		if identifierFunc != nil {
			identifier = identifierFunc()
		}

		result := limiter.IsAllowed(identifier)

		if !result.Allowed {
			writeJSON(w, http.StatusTooManyRequests, map[string]string{
				"error":   "Rate limit exceeded",
				"message": "Too many requests. Please try again later.",
			})
			return
		}

		// Add rate limit info to the response header
		w.Header().Set("X-RateLimit-Limit", strconv.Itoa(limiter.MaxRequests))
		w.Header().Set("X-RateLimit-Remaining", strconv.Itoa(result.Remaining))
		w.Header().Set("X-RateLimit-Reset", strconv.FormatInt(result.ResetAt, 10))
		handler(w, r)
	}
}

// Usage:
// http.HandleFunc("/api/data", rateLimit(apiLimiter, nil, getData))
// http.HandleFunc("/login", rateLimit(authLimiter, nil, login))

// Per-user rate limiting (authenticated):
func getUserIdentifier() string {
	if currentUserIsAuthenticated() {
		return "user:" + currentUserID()
	}
	return "ip:" + requestRemoteAddr()
}

// http.HandleFunc("/api/expensive-operation", rateLimit(apiLimiter, getUserIdentifier, expensiveOperation))

// Circuit breaker protecting external calls from cascade failures.

type CircuitState int

const (
	StateClosed CircuitState = iota // Normal — requests allowed
	StateOpen                       // Failing — requests rejected immediately
	StateHalfOpen                   // Testing recovery — some requests allowed
)

type CircuitBreaker struct {
	failureThreshold int           // fail N times → OPEN
	recoveryTimeout  time.Duration // wait N seconds before HALF_OPEN
	successThreshold int           // succeed N times in HALF_OPEN → CLOSED

	mu            sync.Mutex
	state         CircuitState
	failureCount  int
	successCount  int
	lastFailureAt time.Time
}

func NewCircuitBreaker(failureThreshold, recoveryTimeoutSeconds, successThreshold int) *CircuitBreaker {
	return &CircuitBreaker{
		failureThreshold: failureThreshold,
		recoveryTimeout:  time.Duration(recoveryTimeoutSeconds) * time.Second,
		successThreshold: successThreshold,
		state:            StateClosed,
	}
}

// ErrCircuitOpen is returned while the breaker is open.
var ErrCircuitOpen = errors.New("circuit breaker open — service unavailable")

func (cb *CircuitBreaker) Call(fn func() (interface{}, error)) (interface{}, error) {
	cb.mu.Lock()
	if cb.state == StateOpen {
		// Check whether it's time for recovery
		if time.Since(cb.lastFailureAt) > cb.recoveryTimeout {
			cb.state = StateHalfOpen
			cb.successCount = 0
		} else {
			cb.mu.Unlock()
			return nil, ErrCircuitOpen
		}
	}
	cb.mu.Unlock()

	result, err := fn()
	if err == nil {
		cb.mu.Lock()
		if cb.state == StateHalfOpen {
			cb.successCount++
			if cb.successCount >= cb.successThreshold {
				cb.state = StateClosed
				cb.failureCount = 0
			}
		}
		cb.mu.Unlock()
		return result, nil
	}

	cb.mu.Lock()
	cb.failureCount++
	cb.lastFailureAt = time.Now()
	if cb.failureCount >= cb.failureThreshold {
		cb.state = StateOpen
		log.Printf("Circuit breaker OPEN: too many failures (count=%d)", cb.failureCount)
	}
	cb.mu.Unlock()
	return nil, err
}

// Usage:
var (
	dbCircuit      = NewCircuitBreaker(5, 30, 2)
	paymentCircuit = NewCircuitBreaker(3, 60, 2)
)

// user, err := dbCircuit.Call(func() (interface{}, error) { return userRepo.FindByID(userID) })
// payment, err := paymentCircuit.Call(func() (interface{}, error) { return paymentGateway.Charge(amount, card) })

// Aggressively cache endpoint responses in Redis to reduce backend load.

// redisClient is a go-redis client (import "github.com/redis/go-redis/v9")
var redisClient = redis.NewClient(&redis.Options{Addr: "redis:6379"})
var ctx = context.Background()

// CacheResponse caches endpoint responses.
// varyOn lists the query parameters that affect the cache key.
func CacheResponse(ttl time.Duration, varyOn ...string) func(http.HandlerFunc) http.HandlerFunc {
	return func(next http.HandlerFunc) http.HandlerFunc {
		return func(w http.ResponseWriter, r *http.Request) {
			// Build the cache key from the endpoint + parameters
			keyParts := []string{r.URL.Path}

			if len(varyOn) > 0 {
				for _, param := range varyOn {
					value := r.URL.Query().Get(param)
					keyParts = append(keyParts, param+"="+value)
				}
			} else {
				// Default: vary on all query params
				query := r.URL.Query()
				sortedParams := make([]string, 0, len(query))
				for k, v := range query {
					sortedParams = append(sortedParams, k+"="+v[0])
				}
				sort.Strings(sortedParams)
				keyParts = append(keyParts, sortedParams...)
			}

			sum := md5.Sum([]byte(strings.Join(keyParts, "|")))
			cacheKey := "cache:" + hex.EncodeToString(sum[:])

			// Check the cache
			cached, err := redisClient.Get(ctx, cacheKey).Result()
			if err == nil {
				w.Header().Set("X-Cache", "HIT")
				w.Header().Set("Content-Type", "application/json")
				_, _ = w.Write([]byte(cached))
				return
			}

			// Cache miss — run the handler through a recorder
			rec := httptest.NewRecorder()
			next(rec, r)
			for k, v := range rec.Header() {
				w.Header()[k] = v
			}
			w.Header().Set("X-Cache", "MISS")
			w.WriteHeader(rec.Code)

			// Store in the cache when the response is OK
			if rec.Code == http.StatusOK {
				_ = redisClient.Set(ctx, cacheKey, rec.Body.String(), ttl).Err()
			}
			_, _ = w.Write(rec.Body.Bytes())
		}
	}
}

// Frequently accessed public endpoints — aggressive caching
// http.HandleFunc("/products", CacheResponse(5*time.Minute, "category", "page")(listProducts)) // cache for 5 minutes

// Static endpoints — very long caching
// http.HandleFunc("/api/config", CacheResponse(time.Hour)(getConfig)) // cache for 1 hour

// Monitor traffic and detect anomalies.

type TrafficMonitor struct {
	windowSize          int
	thresholdMultiplier float64
	requestCounts       []requestCount // (timestamp, count)
	baselineRPS         float64        // requests per second baseline
}

type requestCount struct {
	at    time.Time
	count int
}

func NewTrafficMonitor(windowSize int, thresholdMultiplier float64) *TrafficMonitor {
	return &TrafficMonitor{windowSize: windowSize, thresholdMultiplier: thresholdMultiplier}
}

func (m *TrafficMonitor) RecordRequests(count int) {
	now := time.Now()
	m.requestCounts = append(m.requestCounts, requestCount{at: now, count: count})
	// Remove data outside the window
	cutoff := now.Add(-time.Duration(m.windowSize) * time.Second)
	i := 0
	for i < len(m.requestCounts) && m.requestCounts[i].at.Before(cutoff) {
		i++
	}
	m.requestCounts = m.requestCounts[i:]
}

func (m *TrafficMonitor) CurrentRPS() float64 {
	if len(m.requestCounts) == 0 {
		return 0
	}
	total := 0
	for _, rc := range m.requestCounts {
		total += rc.count
	}
	return float64(total) / float64(m.windowSize)
}

func (m *TrafficMonitor) IsAnomalous() bool {
	current := m.CurrentRPS()
	if m.baselineRPS == 0 {
		return false
	}
	// Anomaly if traffic exceeds N times the baseline
	return current > m.baselineRPS*m.thresholdMultiplier
}

func (m *TrafficMonitor) UpdateBaseline(rps float64) {
	if m.baselineRPS == 0 {
		m.baselineRPS = rps
	} else {
		// Exponential moving average
		m.baselineRPS = 0.9*m.baselineRPS + 0.1*rps
	}
}

// Detection based on IP distribution
type IPAnomalyDetector struct {
	window   int
	ipCounts map[string][]time.Time
}

func NewIPAnomalyDetector(windowSeconds int) *IPAnomalyDetector {
	return &IPAnomalyDetector{window: windowSeconds, ipCounts: map[string][]time.Time{}}
}

func (d *IPAnomalyDetector) RecordRequest(ip string) {
	now := time.Now()
	d.ipCounts[ip] = append(d.ipCounts[ip], now)
	// Remove old data
	cutoff := now.Add(-time.Duration(d.window) * time.Second)
	times := d.ipCounts[ip]
	i := 0
	for i < len(times) && times[i].Before(cutoff) {
		i++
	}
	d.ipCounts[ip] = times[i:]
}

type SuspiciousIP struct {
	IP    string
	Count int
	Rate  float64
}

// Return IPs with more than the threshold of requests in the window.
func (d *IPAnomalyDetector) SuspiciousIPs(threshold int) []SuspiciousIP {
	var suspicious []SuspiciousIP
	for ip, times := range d.ipCounts {
		if len(times) > threshold {
			suspicious = append(suspicious, SuspiciousIP{
				IP:    ip,
				Count: len(times),
				Rate:  float64(len(times)) / float64(d.window),
			})
		}
	}
	sort.Slice(suspicious, func(a, b int) bool {
		return suspicious[a].Count > suspicious[b].Count
	})
	return suspicious
}

// Middleware for monitoring
var (
	monitor    = NewTrafficMonitor(60, 3.0)
	ipDetector = NewIPAnomalyDetector(60)
)

func monitorTraffic(next http.HandlerFunc) http.HandlerFunc {
	return func(w http.ResponseWriter, r *http.Request) {
		ip := r.RemoteAddr
		monitor.RecordRequests(1)
		ipDetector.RecordRequest(ip)

		// Check for anomalies every N requests to avoid overhead
		if monitor.IsAnomalous() {
			log.Printf("Traffic anomaly detected: current=%.2f rps baseline=%.2f rps",
				monitor.CurrentRPS(), monitor.baselineRPS)
		}

		// Block very aggressive IPs (can also be done at the nginx level)
		suspicious := ipDetector.SuspiciousIPs(200)
		for _, s := range suspicious {
			if s.IP == ip {
				writeJSON(w, http.StatusTooManyRequests, map[string]string{
					"error": "Too many requests from your IP",
				})
				return
			}
		}
		next(w, r)
	}
}

// Endpoints vulnerable to resource exhaustion:

func searchVulnerable(w http.ResponseWriter, r *http.Request) {
	// Unbounded complex queries
	query := r.URL.Query().Get("q")
	results := productRepo.Search(query) // full table scan on a large table
	writeJSON(w, http.StatusOK, results)
}

// If attackers send 50 concurrent requests to this endpoint → database overload

// CORRECT: resource-aware endpoints
func searchSafe(w http.ResponseWriter, r *http.Request) {
	query := strings.TrimSpace(r.URL.Query().Get("q"))

	// Validate the minimum query length
	if len(query) < 3 {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "Query must be at least 3 characters"})
		return
	}

	// Limit the query length
	if len(query) > 100 {
		writeJSON(w, http.StatusBadRequest, map[string]string{"error": "Query too long"})
		return
	}

	// Use a full-text index, not LIKE %...%
	// Limit the results
	results := productRepo.SearchFullText(query, 50)
	writeJSON(w, http.StatusOK, results)
}

// Expensive operations must be queued, not processed synchronously
func generateReport(w http.ResponseWriter, r *http.Request) {
	// Don't process directly — put it in a queue
	job := reportQueue.Enqueue(GenerateReportTask{
		UserID:     currentUserID(r),
		Payload:    r.Body,
		JobTimeout: 5 * time.Minute, // maximum 5 minutes
	})
	writeJSON(w, http.StatusAccepted, map[string]string{ // 202 Accepted
		"job_id":    job.ID,
		"status":    "queued",
		"check_url": "/reports/status/" + job.ID,
	})
}

// Registration (using net/http):
// http.HandleFunc("/search", rateLimit(apiLimiter, nil, searchSafe))
// http.HandleFunc("/reports/generate", rateLimit(authLimiter, nil, generateReport))

// ✗ Anti-pattern 1: no rate limiting at all
// Every endpoint accessible without limits
// One client can make thousands of requests per second

// ✗ Anti-pattern 2: rate limiting too easily bypassed
// Limits only based on IPs — easily bypassed with many IPs
// or by using proxies/VPNs
// ✓ Solution: combine IP + user ID + fingerprinting

// ✗ Anti-pattern 3: synchronous processing for expensive operations
// func exportCSV(w http.ResponseWriter, r *http.Request) {
//     data := orderRepo.FindAll() // OOM risk
//     generateCSV(w, data)        // timeout risk
// }
// ✓ Solution: queue to background workers, return job IDs

// ✗ Anti-pattern 4: no timeouts for downstream dependencies
// resp, err := http.Get("https://external-api.com/data") // no timeout
// ✓ Solution: always set timeouts
// client := &http.Client{Timeout: 10 * time.Second}

// ✗ Anti-pattern 5: caches abusable for cache poisoning
// func getProfile(w http.ResponseWriter, r *http.Request) {
//     // Without ownership validation, attackers can cache
//     // other users' responses and serve them to others
//     profile := userRepo.FindByID(userID)
//     writeJSON(w, http.StatusOK, profile)
// }
// ✓ Solution: cache keys must include the authenticated user ID for private data

// ✗ Anti-pattern 6: no traffic monitoring
// DDoS spikes only discovered after systems go down
// ✓ Solution: real-time alerting for RPS anomalies