What are some strategies to prevent flooding/abuse of api requests

Question

I have an API on my server(node) that writes new data into my database. To use the API the user is required to provide a token which acts as an identifier. So if someone floods my database or abuses the api, I can tell who it is.

But, what are some techniques I can use to prevent the ability to flood or hang my server all together? Notice that most request to the API are done by the server itself, so, in theory I might get dozens of requests a second from my own server's address.

I'd love to get some references to reading materials.

Thanks!

Answer 1

You could use this module: https://www.npmjs.com/package/ddos to put limits depending on the user.

However you will still be exposed to larger scale ddos attacks. These attacks cannot be stopped at the node.js level since they often target infrastructure. This is another can of worms however.