Throttling and Blocking Bad Requests in Phoenix Web Applications with PlugAttack
(Also posted in the Elixir blog posts thread, seems appropriate here)
I published a tutorial on how credential stuffing attacks can occur against a Phoenix application, and some strategies to mitigate them using PlugAttack. The post walks through:
- Setting up a victim application, named orru
- Using a basic script to perform automated logins, envy
- The throttle and fail2ban rules in PlugAttack, and some potential pitfalls you may run into when setting them up, and how to avoid them
Thank you for reading!
