Web Application Firewall:Account security best practices

Use CAPTCHA for webpages and H5

A CAPTCHA is one of the simplest and most effective ways to protect critical interfaces on PC or H5 webpages. Integrating a CAPTCHA service typically requires minor changes to your application code and the integration usually takes one to two business days.

A basic CAPTCHA can effectively block direct API calls made from simple tools and scripts. However, as attack methods and tools evolve, basic CAPTCHAs are becoming easier to bypass. For stronger protection, use a professional CAPTCHA service.

Use SDK signing

For native apps where a CAPTCHA is not suitable, Alibaba Cloud provides an SDK solution. The SDK collects hardware and environment information from the mobile device to sign and validate requests. This process forwards only requests from legitimate, official apps to the origin server and blocks requests from scripts, automated programs, emulators, or other unauthorized sources.

Multi-dimensional rate limiting

For attacks where requests share a common high-frequency characteristic, such as a common IP address, session, cookie, parameter, or header, you can use multi-dimensional rate limiting to block the source. For example, if an attacker uses a large number of proxy IP addresses but reuses the same session cookie, such as a uid, you can rate-limit by cookie. This shifts protection from targeting IP addresses to an "account" dimension tied to your business logic.

Example configuration: Set Rule Name to test and Match Condition to URL Prefix Match /login.php. Enable frequency settings, set the statistical object to Custom Cookie and enter the cookie name uid, set the Statistical Duration to 60 seconds, and set the Threshold to 10. For the action, select slider CAPTCHA with a Timeout of 1,800 seconds, and set the Protection Type to CC attack protection.

Analyze anomalous request characteristics

For most attacks, careful observation and analysis reveal differences between malicious requests and legitimate user traffic. The following are some common anomalous request characteristics.

• Incomplete HTTP headers. For example, requests might be missing fields such as referer, cookie, or content-type.

• Anomalous User-Agent values. For example, a large volume of requests to a standard website might have User-Agent strings typical of Java or Python clients, or requests to a WeChat mini program might have User-Agent strings from desktop browsers.

• Incomplete cookies. A typical application uses multiple cookies with business-specific meanings, such as SessionID, userid, deviceid, and lastvisit. However, a bot might only submit the one or two cookies required to get a result, omitting others that are part of a normal user session.

• Requests may contain missing or repeated parameters that do not affect the result.

• Anomalous data in business fields. For example, email addresses, phone numbers, or account information might contain unusual or illogical keywords.

Credential stuffing and bot threat intelligence

The Bot Management module in WAF uses algorithms to identify malicious IP addresses associated with credential stuffing across the Alibaba Cloud network. This data forms a dynamically updated credential stuffing IP intelligence database. You can use the Bot Threat Intelligence feature in the Bot Management module to enable credential stuffing IP detection. Set the rule to Monitor mode or configure an action, such as Block or slider CAPTCHA, for matching IP addresses. For more information, see Set up Bot Threat Intelligence rules.