This lesson's interactive features are locked, please to keep using them

DoS

A Denial-of-Service (DoS) attack isn't like most "hacks"... it has nothing to do with "breaking in." It's about overwhelming a system so its regular users can't use it.

Attackers use DoS for extortion, sabotage, or distraction while they exploit another vulnerability.

A "regular" DoS attack comes from a single source. It's a flood of requests – sometimes hundreds, thousands, or even millions per second – that can overwhelm your server's ability to respond to anything else.

I've DoS'd myself by accident by running a local script against my own API that does some expensive operation (like aggregating user metrics) in a tight loop without any rate limiting. Oops.

A single-source DoS is much easier to handle than a distributed attack, but blocking one IP address isn't always enough. Shared networks can put many legitimate users behind one address, and a single expensive request can do plenty of damage on its own.

Assignment

Bearly Secure has no application-wide traffic ceiling. FixedWindowRateLimiter already handles fixed-window counters, client keys, headers, and limit responses. Finish createRateLimiter in src/security/rateLimit.ts, then apply it globally.

Create one FixedWindowRateLimiter from the options passed to createRateLimiter.
Return middleware that calls consume with the request.
1. When the limiter reports that the request is limited, reject it and return without calling next.
2. Otherwise, set the rate-limit headers and call next.
In src/app.ts, use a new global rate limiter configured for 100 requests per minute.
Keep the /health route outside the limit so infrastructure can still check the app.
Start the app.

The in-memory store is deliberate for this local exercise. A multi-instance production deployment needs a shared limiter at the edge or a shared store so every instance sees the same counters.

With Bearly Secure still running, run and submit the CLI tests from the project root.