How to leave client waiting for Java JAX-RS service to prevent DOS -

i'm having issue web service users trying guess application ids looping on random ids.

the bad requests coming random ips, cannot ban ip (unless dynamically, i'm not looking yet).

currently when detect client has made 10 bad app id attempts put them on block list in app, , reject further requests ip day.

i want minimize amount of work server needs do, bad client continue send 1000s of requests though rejected. know there dynamic firewall solutions, want easy implement in app now. sleeping 5 seconds reduce calls, want not send response client, has timeout.

anyone know how in java, in jax-rs?

my service like,

@path("/api") public class myserver {  @get @consumes(mediatype.application_xml) @produces(mediatype.application_xml) @path("/my-request") public string myrequest(string type,     @context httpservletrequest requestcontext,     @context httpservletresponse response) { ... } 

see: how stop hack/dos attack on web api

you looking asynchronous responses supported jax-rs. tutorial jersey contains examples on how implement asynchronous response request.

with asynchronous responses, thread resposible answering request freed handling request before request completed. feature activated adding parameter @suspended annotation. need additionally, register dedicated scheduler responsible waking requests after given time-out in example:

@path("/api") public class myserver {    private scheduledexecutorservice scheduler = ...;    @get   @consumes(mediatype.application_xml)   @produces(mediatype.application_xml)   @path("/my-request")   public string myrequest(string type,                           @context httpservletrequest requestcontext,                           @context httpservletresponse response,                           @suspended asyncresponse asyncresponse) {     scheduler.schedule(new runnable() {       @override       public void run() {         asyncresponse.resume(...)       }     }, 5, timeunit.second);   } } 

this way, no thread blocked waiting time of 5 seconds gives opportunity handling other requests in mean time.

jax-rs not offer way of discaring request without answer. need keep connection open prodcue time out, if terminate connection, user notfied of termination. best never answer asynchronous request still consume ressources. if wanted avoid this, have solve problem outside of jax-rs, example proxying request server.

one way set mod_proxy answer proxy error code mallicious requests , set large retry limit such requests.