Answers: <p>You can rate limit or throttle based on the IP: <a href="https://docs.microsoft.com/en-us/azure/api-management/api-management-sample-flexible-throttling#ip-address-throttling" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/azure/api-management/api-management-sample-flexible-throttling#ip-address-throttling</a></p>
  <p>Also, Azure DDoS Protection Basic doesn't cover much. It won't know what is normal or not for your application without paying the ~$3,000 per month for the Standard plan.</p>
  
Answers: CC BY-SA 4.0
Answers: 2021-05-12T17:22:13.833Z
Answers: 2021-05-12T17:22:13.833Z
Answers: Wes
Body: <p>You have an open facing Azure API Gateway that can be consumed by anyone and you want to protect yourself from the API being spammed by the same IP or the same individual behind multiple IP's.</p>
  <p>There are policies one can configure within API Management to:</p>
  <ul>
  <li><a href="https://docs.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies#LimitCallRate" rel="nofollow noreferrer">Limit call rate by subscription</a></li>
  <li><a href="https://docs.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies#LimitCallRateByKey" rel="nofollow noreferrer">Limit call rate by key</a></li>
  <li><a href="https://docs.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies#SetUsageQuota" rel="nofollow noreferrer">Set usage quota by subscription</a></li>
  <li><a href="https://docs.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies#SetUsageQuotaByKey" rel="nofollow noreferrer">Set usage quota by key</a></li>
  <li><a href="https://docs.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies#RestrictCallerIPs" rel="nofollow noreferrer">Restrict caller IP's</a></li>
  </ul>
  <p>Setting limits by subscription (specific consumers) or key (specific apps) wouldn't work because your API is open to the public, and the last option of restricting caller IP's one-by-one doesn't prevent the issue from happening in the first place.</p>
  <p>How do you protect against the same user (IP) repeatedly crushing your rate or quota limits? Additionally, how would you protect against that same user doing this across multiple IP's?</p>
  <p>My guess is that this is likely covered in <a href="https://docs.microsoft.com/en-us/azure/security/fundamentals/ddos-best-practices#azure-offerings-for-ddos-protection" rel="nofollow noreferrer">Azure's DDoS Protection Basic</a> but I felt that I couldn't get a concrete answer out of those docs.</p>
  
Tags: <azure-devops><azure>
Title: How do you stop malicious requests in Azure APIM from repeatedly hitting your rate or quota limits?
UserDisplayName: 8protons
ThreadText: # How do you stop malicious requests in Azure APIM from repeatedly hitting your rate or quota limits?
  
  (Asked by: username_0 on 2021-04-02)
  
  You have an open facing Azure API Gateway that can be consumed by anyone and you want to protect yourself from the API being spammed by the same IP or the same individual behind multiple IP's.
  
  There are policies one can configure within API Management to:
  
  * [Limit call rate by subscription](https://docs.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies#LimitCallRate)
  * [Limit call rate by key](https://docs.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies#LimitCallRateByKey)
  * [Set usage quota by subscription](https://docs.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies#SetUsageQuota)
  * [Set usage quota by key](https://docs.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies#SetUsageQuotaByKey)
  * [Restrict caller IP's](https://docs.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies#RestrictCallerIPs)
  
  Setting limits by subscription (specific consumers) or key (specific apps) wouldn't work because your API is open to the public, and the last option of restricting caller IP's one-by-one doesn't prevent the issue from happening in the first place.
  
  How do you protect against the same user (IP) repeatedly crushing your rate or quota limits? Additionally, how would you protect against that same user doing this across multiple IP's?
  
  My guess is that this is likely covered in [Azure's DDoS Protection Basic](https://docs.microsoft.com/en-us/azure/security/fundamentals/ddos-best-practices#azure-offerings-for-ddos-protection) but I felt that I couldn't get a concrete answer out of those docs.
  
  **Tags:** azure-devops, azure
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2021-05-12. Score: 1
  
  You can rate limit or throttle based on the IP: <https://docs.microsoft.com/en-us/azure/api-management/api-management-sample-flexible-throttling#ip-address-throttling>
  
  Also, Azure DDoS Protection Basic doesn't cover much. It won't know what is normal or not for your application without paying the ~$3,000 per month for the Standard plan.
  
  
  ---
  
  