What protections do you have in front of our App Proxy APIs? As in what security is there to protect from DDOS attacks? Scrapers? Malicious bots? Suspicious behaviour?
I am wondering this as we’ve seen some different kinds of attacks hit our App Proxy API. I’m going to use a recent incident as an example where an attacker sent over 300 requests from a single IP within 3 minutes, which luckily most were blocked due to our own rate limiting. Now these requests were clearly an attacker attempting SQL injection through various methods on our API through a single endpoint, clearly a script too. I’m just very surprised that if there is a WAF / Bot Protection inside App Proxy, how this behaviour easily got through?
I cant find any information online about if Shopify has any protection on App Proxy APIs so I’m just looking for some information and assurance in this area.
Hey @Drew_Loynes - thanks for flagging this. I definitely get why that was surprising, especially since the requests reached your app through Shopify’s App Proxy.
App Proxy requests come through the storefront, so Shopify’s general online-store protections are in front of them, including Cloudflare’s WAF and DDoS protection:
These protections filter a lot of automated traffic, but they can’t guarantee that every malicious request or payload will be blocked. The traffic you saw was definitely suspicious, though 300 requests over three minutes works out to around 1.7 requests per second. I’ve seen legitimate storefront AJAX traffic reach similar levels, so the volume alone might not look like a DDoS attack.
App Proxy requests are also signed, but that signature only confirms Shopify forwarded the request without it being altered. It doesn’t mean the original visitor or their input is trusted:
So it’s still important to validate the signature, treat the input as untrusted, use parameterized queries though, and keep app-side rate limiting in place. It sounds like your rate limiting did its job here.
Let me know if I can clarify anything else on our end. I’m also happy to pass along a feature request for you for sure since I realize it’s not the most ideal in circumstances like that.