Handling Multiple Requests from the Same IP in SAP Commerce Cloud

[FelipeLima1]

In SAP Commerce Cloud, it's possible to configure IP blocking. However, is there any standard functionality in SAP Commerce that can detect when an IP is performing an attack (e.g., through multiple suspicious requests) and automatically block that IP?

I'm currently exploring standard solutions for this scenario, but if none are available, I'm considering customizing a filter to detect and block potentially malicious IPs.

[StefanKruk]

Hi,

There are some safety measures in SAP CX Standard.
For Example can you configure the "Max Brute Force Login Attempts" per User Group. It will also go Up in the Hierarchy of User Groups to find a Value.
If nothing is maintained the Login attempts will be not restricted.
If you have multiple User Groups assigned with different values, the lowest value will be used.

If you have too many Login attempts your account will be disabled and the Customer needs to contact the Support, to re-enable the Account.

Additionally SAP has a "BruteForceAttackHandler" which will be for example be used for applying Vouchers in the "BaseCommerceController"

protected CartData applyVoucherForCartInternal(final String voucherId, final HttpServletRequest request)
       throws NoCheckoutCartException, VoucherOperationException
{
    final String ipAddress = request.getRemoteAddr();
    if (bruteForceAttackHandler.registerAttempt(ipAddress + "_voucher"))
    {
       throw new VoucherOperationException("You have entered too many voucher codes. Please try again later.");
    }

    return applyVoucherForCartInternal(voucherId);
}

In the CCv2 Cloud Portal you are also able to configure WAF Settings.
See: https://me.sap.com/notes/0003417716 and https://help.sap.com/docs/SAP_COMMERCE_CLOUD_PUBLIC_CLOUD/0fa6bcf4736c46f78c248512391eb467/5ba356136...

Further SAP CX has a default "XSSFilter" (de.hybris.platform.servicelayer.web.XSSFilter) which is based on configured Regular Expression Rules. The Properties has the following syntax:

xss.filter.rule.<ruleName> = <regEx>

or

<extensionName>.xss.filter.rule.<ruleName> = <regEx>

 If it is detected that the Regular Expression is matching the values will be stripped.
You can also configure it to be rejected via:

xss.filter.action=REJECT

The general and "commercewebservice" Rules will also be applied to Requests with a JSON Body through the "de.hybris.platform.webservicescommons.jaxb.adapters.XSSStringAdapter"

Commercewebservices Rules have the format:

commercewebservices.xss.filter.rule.<ruleName> = <regEx>

 and the Values will then be stripped from the Input

Kind Regards,
Stefan Kruk