{"id":142,"date":"2026-10-19T15:08:26","date_gmt":"2026-10-19T15:08:26","guid":{"rendered":"https:\/\/nino.to\/insights\/2026\/10\/19\/bao-mat-api-doanh-nghiep-rate-limiting-jwt-ddos\/"},"modified":"2026-10-19T15:08:26","modified_gmt":"2026-10-19T15:08:26","slug":"bao-mat-api-doanh-nghiep-rate-limiting-jwt-ddos","status":"publish","type":"post","link":"https:\/\/nino.to\/vi\/insights\/bao-mat-api-doanh-nghiep-rate-limiting-jwt-ddos\/","title":{"rendered":"B\u1ea3o M\u1eadt API Doanh Nghi\u1ec7p: Rate Limiting, OAuth 2.0, JWT V\u00e0 Ch\u1ed1ng T\u1ea5n C\u00f4ng DDoS"},"content":{"rendered":"<h2>C\u1ed5ng API: M\u1ee5c ti\u00eau h\u00e0ng \u0111\u1ea7u c\u1ee7a tin t\u1eb7c<\/h2>\n<p>H\u01a1n 80% l\u01b0u l\u01b0\u1ee3ng truy c\u1eadp Internet hi\u1ec7n nay l\u00e0 c\u00e1c l\u1ec7nh g\u1ecdi API. Vi\u1ec7c b\u1ea3o v\u1ec7 endpoint kh\u00f4ng ch\u1ec9 d\u1eebng l\u1ea1i \u1edf x\u00e1c th\u1ef1c ng\u01b0\u1eddi d\u00f9ng m\u00e0 c\u00f2n ph\u1ea3i ng\u0103n ng\u1eeba c\u00e1c h\u00e0nh vi khai th\u00e1c l\u1ed7 h\u1ed5ng logic nghi\u1ec7p v\u1ee5.<\/p>\n<h2>Nguy\u00ean t\u1eafc b\u1ea3o v\u1ec7 API \u0111a t\u1ea7ng<\/h2>\n<ul>\n<li>Gi\u1edbi h\u1ea1n t\u1ea7n su\u1ea5t g\u1ecdi (Rate Limiting) b\u1eb1ng thu\u1eadt to\u00e1n Token Bucket ho\u1eb7c Leaky Bucket l\u01b0u tr\u00ean Redis.<\/li>\n<li>S\u1eed d\u1ee5ng JSON Web Token (JWT) c\u00f3 th\u1eddi h\u1ea1n ng\u1eafn (15 ph\u00fat) k\u1ebft h\u1ee3p Refresh Token an to\u00e0n trong HttpOnly Cookie.<\/li>\n<li>\u1ee8ng d\u1ee5ng WAF (Web Application Firewall) c\u1ee7a Cloudflare \u0111\u1ec3 ph\u00e1t hi\u1ec7n v\u00e0 ng\u0103n ch\u1eb7n bot \u0111\u1ed9c h\u1ea1i t\u1eeb r\u00eca m\u1ea1ng.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>C\u00e1c bi\u1ec7n ph\u00e1p ph\u00f2ng v\u1ec7 nhi\u1ec1u l\u1edbp gi\u00fap b\u1ea3o v\u1ec7 c\u1ed5ng API c\u00f4ng khai tr\u01b0\u1edbc c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng Brute-force, \u0111\u00e1nh c\u1eafp danh t\u00ednh v\u00e0 t\u1eeb ch\u1ed1i d\u1ecbch v\u1ee5 ph\u00e2n t\u00e1n.<\/p>\n","protected":false},"author":1,"featured_media":143,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_gspb_post_css":"","footnotes":""},"categories":[23],"tags":[32,43,25,24,42],"class_list":["post-142","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cloud-security","tag-bao-mat-dam-may","tag-enterprise","tag-insights","tag-nino","tag-tech"],"_links":{"self":[{"href":"https:\/\/nino.to\/vi\/insights\/wp-json\/wp\/v2\/posts\/142","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nino.to\/vi\/insights\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nino.to\/vi\/insights\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nino.to\/vi\/insights\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nino.to\/vi\/insights\/wp-json\/wp\/v2\/comments?post=142"}],"version-history":[{"count":0,"href":"https:\/\/nino.to\/vi\/insights\/wp-json\/wp\/v2\/posts\/142\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nino.to\/vi\/insights\/wp-json\/wp\/v2\/media\/143"}],"wp:attachment":[{"href":"https:\/\/nino.to\/vi\/insights\/wp-json\/wp\/v2\/media?parent=142"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nino.to\/vi\/insights\/wp-json\/wp\/v2\/categories?post=142"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nino.to\/vi\/insights\/wp-json\/wp\/v2\/tags?post=142"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}