API Xavfsizligi va Rate Limiting: Token Bucket, DDoS va HMAC

Nega Standart Veb Himoyasi API Uchun Yetarli Emas?

L3/L4 vs L7 DDoS: Nega HTTP Flood Xavfliroq?

Rate Limiting Algoritmlari: Qaysi Biri Qachon Qo'llanadi?

Nega Lokal Xotira Kifoya Qilmaydi? Redis & Atomar Lua

HMAC-SHA256: So'rovlarni Imzolash va Replay Hujumlariga Barham Berish

Node.js da HMAC Tekshirish va Token Bucket Middleware

const crypto = require('crypto');

// 1. HMAC-SHA256 Request Signature Verification Middleware
function verifyHmacSignature(secretKey, nonceCache) {
  return (req, res, next) => {
    const signature = req.headers['x-signature'];
    const timestamp = parseInt(req.headers['x-timestamp'], 10);
    const nonce = req.headers['x-nonce'];

    if (!signature || !timestamp || !nonce) {
      return res.status(401).json({ error: 'Missing security headers' });
    }

    // Replay attack prevention: 5-minute validity window
    const now = Math.floor(Date.now() / 1000);
    if (Math.abs(now - timestamp) > 300) {
      return res.status(401).json({ error: 'Request timestamp expired (Time Skew)' });
    }

    // Check if nonce was already consumed
    if (nonceCache.has(nonce)) {
      return res.status(401).json({ error: 'Replay attack detected: Nonce already used' });
    }
    nonceCache.add(nonce); // Store nonce in memory/Redis with TTL

    // Build canonical string and recalculate HMAC
    const payload = JSON.stringify(req.body || {});
    const canonical = `${req.method}|${req.path}|${timestamp}|${nonce}|${payload}`;
    const expectedSig = crypto.createHmac('sha256', secretKey).update(canonical).digest('hex');

    // Constant-time comparison to prevent timing attacks
    if (!crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expectedSig))) {
      return res.status(403).json({ error: 'Invalid HMAC signature: Payload tampered!' });
    }
    next();
  };
}

T-Mobile 2023 Falokati va Cloudflare 71M RPS Rekordi

API Gateway, WAF va TLS Fingerprinting (JA4)

Amaliy Ish: API Defender Studio — Token Bucket va HMAC Laboratoriyasi

API Xavfsizlik Choralarining Taqqoslama Matritsasi

Xulosa va Uy Vazifasi: Bank API Himoya Spetsifikatsiyasi