Grails / Tomcat: Avoiding denial of service attacks

Question

I have a Grails application running on Tomcat, with MySQL as the database server.

I've found through testing that it's very easy to create a Denial of Service attack on the site simply by refreshing a page multiple times (i.e., holding down F5). This causes load on the server to increase rapidly along with the number of connections to the MySQL database.

Eventually, the site becomes unresponsive, and it can take several minutes for things to return to normal.

Can anyone recommend ways to debug this?

Should I be looking at caching?

Answer 1

I don't recommend handling DOS attacks at a grails layer. I always recommend putting a server like nginx or apache in front of a java web application. The web server can then be configured to proxy your web appplication. A firewall in front of the web server creates another layer of security. If you try to address DOS attacks at a web application layer you are most likely too late.

A quick reference on DOS is here: http://en.wikipedia.org/wiki/Denial-of-service_attack

Caching is not meant to fix DOS attacks btw. It is meant to improve application performance. A lot of DOS attacks occur on the socket level.

Again I would not recommend preventing DOS at a web application level. Regardless of the language you are writing in.

The other question that I have is have you load tested your application? You may be running into base performance issues. I would recommend looking at a commercial tool or web based load tuning services. I am guessing that you are actually seeing a custom web app performance issue, not an issue with DOS.