Hi everyone, I'm new here and have been reading up on WAF and DDoS solutions. My team is using a major cloud provider's built-in WAF, but we're hitting a wall with a specific issue and I'm curious about Cloudflare's approach.
We have a public-facing API endpoint for user registration that's been targeted by short, bursty HTTP flood attacks a couple times now. The traffic looks like legitimate POST requests, just way too many of them, and it overwhelms that single endpoint while the rest of our app is fine. Our current tool seems to only offer rate limiting per IP, which isn't enough when the attack uses a large pool of IPs.
I'm trying to understand the best practice here. For those using Cloudflare's WAF and DDoS protection:
1. Is the "rate limiting" rule in the WAF the primary tool for this? I've read it can use criteria like "rate per client IP" or even "rate per session," but I'm unsure how effective that is against distributed attacks.
2. How do you handle distinguishing between a legitimate traffic spike (like a marketing campaign) and an attack on one endpoint? Does Cloudflare have a way to automatically learn or adapt to your normal traffic patterns for a specific path?
3. I'm also cautious about cost. If we get hit by a big attack, does the magic "under attack mode" or advanced mitigation incur surprise fees, or is that covered under a standard Pro/Business plan?
Any insights on your setup or what to watch out for would be super helpful. We're a small team, so I'm trying to get this right without overcomplicating things.