如何使Web Service报告过载？

Question

I am making a Web Service that implements a function that takes input parameters and stores them in database. (The code is in Java, written using NetBeans IDE, deployed on WebLogic server.) Something like this:

@WebService
class DataSaver {
    void saveData( ...data... ) {
        ...
    }
}

It's already completed and it seems to work correctly, so now I am concerned about safety:

What happens if too many clients would connect at the same time (or someone would do a Denial-of-Service attack on my site), so the server would not be able to correctly process all the requests?

1) I would prefer if the server/application does not crash . What mechanisms are there to send away the request in case of overload? Are they enabled by default? If not, how do I turn them on?

2) Since the web service function does not return a value (and I would prefer to keep its code as it is now, if possible), the clients can tell the difference between processed and unprocessed request only by HTTP error code. So I would prefer the solution to return a HTTP error code in case of overload.

I am not very familiar with Web Services and performance tuning (I am more of a theoretical programmer; algorithms and stuff), so I don't even know what to look for. Solving this problem in Java seems to me too late -- when the message gets to my code, the XML request was already parsed. I would expect some parameter in server configuration to handle this; but I did not succeed to find it by Google or reading a WebLogic manual. Perhaps I am using the wrong keywords, or I have a completely wrong idea how to approach this problem... which is why a partial answer could also be very useful.

Answer 1

If you want to defend against DOS attacks then you can obtain software/hardware to do that.

If you want to do it in code then you could write you own javax.servlet.Filter. You could simply keep a count of active requests and reply with HTTP 502 or whatever you require.

Answer 2

As a general rule : don't code, use. It applies well for DoS attacks prevention, Wikipedia has a good list of Prevention and response checklist :

• Firewalls configuration
• Switches configuration
• Routers configuration
• Application front end hardware
• IPS based prevention
• DDS based defense systems
• Blackholing and sinkholing
• Clean pipes

DoS prevention is a hard topic that must be tackled by security professionals (and you are not from what you say).

If you are alone creating a small WebService for few clients, you don't even have to think to prevent DoS attacks as you're not likely to ever encounter such attack.

If the DoS prevention is something mandatory for you and for good reasons, then ask security professionals because you'll have to take into consideration the following types of DoS attacks :

• ICMP flood
• SYN flood
• Teardrop attacks
• Low-rate Denial-of-Service attacks
• Peer-to-peer attacks
• Asymmetry of resource utilization in starvation attacks
• Permanent denial-of-service attacks
• Application-level floods
• Nuke
• RU-Dead-Yet?
• Distributed attack
• Reflected / Spoofed attack
• Unintentional denial of service
• Denial-of-Service Level II

Now if you just wish your legitimate users to be able to know if the service ran fine or failed, just use the classic behavior of your Web Server : if too many legitimate users happen to connect at the same time, then your code will fail with an Exception. Your servlet server will then respond with a 503 HTTP error code . This code will tell your users that something went wrong.