just using python & gevent.server to server a simple login server(just check some data and do some db operation), would it be a problem when it's under ddos attack?
would it be better if using apache/ngnix to server http request?
In my opinion, you will never get the same level of security with a pure-Python server that you could have with majors web servers, as Apache and Nginx are.
These are well-tested before being released, so, by using a stable build and by configuring it properly, you will be close of the maximum of security possible.
Pure-python servers are very usefull during development, but I do not know any that can claim to compete with them for security testing / bug report / quick fix.
This is why it is generally advisable to put one of these servers in front before the server in pure python, using, for example, options like ProxyPass.
http server using python & gevent(not using apache)