In a Nodejs application, I am having a login API, which takes in phone number, creates a new record in the database with that number if it doesn’t exists. Sends otp to user to login. At first, i didn’t had any security on this API, therefore someone found this api and started hitting it with multiple random numbers. I got to know about this when i found large number of records on a particular day. Which was unusual than other days. I analyzed the logs and found that someone is hitting api again and again multiple times.

Temporary fixes:
I have implemented temporary solution (Not sure if it’s temporary or permanent way).
1. Allowed customer to try only 3 unverified otp login attempt in 24 hour. Block him if it reaches limit.
2. Applied rate limiting (Allowing to use login api only 5 times in 24hr from same IP)
3. Blocked IP of attacker by understanding number of requests. By blocking i mean, i didn’t allow him to access any of the apis available in the system

For tracking purpose, I have started capturing below details at DB level, so that i can analyze incoming requests behavior and identify such cases.

Details getting saved:

• Request date time, method, user agent, client ip, request url, request body

I need help to tackle these kind of issues correctly. Kindly help me with solution options.

Thank you
Much appreciated 🙂