# 🏗️ Security Architecture ## Multi-Layer Defense System ``` ┌─────────────────────────────────────────────────────────────────┐ │ ATTACKER │ │ (41.44.117.225) │ │ /api/products/search?q=t │ └────────────────────────┬────────────────────────────────────────┘ │ ▼ ┌─────────────────────────────────────────────────────────────────┐ │ LAYER 1: FIREWALL │ │ ┌──────────────────────────────────────────────────────────┐ │ │ │ UFW / iptables │ │ │ │ • IP blacklist │ │ │ │ • Port filtering │ │ │ │ • Permanent blocks │ │ │ └──────────────────────────────────────────────────────────┘ │ │ ✅ PASS or ❌ DROP │ └────────────────────────┬────────────────────────────────────────┘ │ ▼ ┌─────────────────────────────────────────────────────────────────┐ │ LAYER 2: NGINX │ │ ┌──────────────────────────────────────────────────────────┐ │ │ │ Rate Limiting Zones │ │ │ │ • search_limit: 2 req/sec │ │ │ │ • api_limit: 10 req/sec │ │ │ │ • login_limit: 5 req/min │ │ │ │ • conn_limit: 10 concurrent │ │ │ │ │ │ │ │ Additional Checks │ │ │ │ • User-agent validation │ │ │ │ • IP blacklist (blocked-ips.conf) │ │ │ │ • Request size limits │ │ │ └──────────────────────────────────────────────────────────┘ │ │ ✅ PASS or ❌ 429 │ └────────────────────────┬────────────────────────────────────────┘ │ ▼ ┌─────────────────────────────────────────────────────────────────┐ │ LAYER 3: PHP-FPM │ │ ┌──────────────────────────────────────────────────────────┐ │ │ │ Worker Pool Management │ │ │ │ • 5 workers (configurable) │ │ │ │ • Request timeout: 30s │ │ │ │ • Memory limit: 256M │ │ │ └──────────────────────────────────────────────────────────┘ │ │ ✅ PASS or ⏱️ TIMEOUT │ └────────────────────────┬────────────────────────────────────────┘ │ ▼ ┌─────────────────────────────────────────────────────────────────┐ │ LAYER 4: LARAVEL GLOBAL │ │ ┌──────────────────────────────────────────────────────────┐ │ │ │ API Middleware Group │ │ │ │ • throttle:1200,1 (1200 req/min per IP) │ │ │ │ • Tenancy initialization │ │ │ │ • Subscription check │ │ │ │ • Authentication │ │ │ └──────────────────────────────────────────────────────────┘ │ │ ✅ PASS or ❌ 429/401 │ └────────────────────────┬────────────────────────────────────────┘ │ ▼ ┌─────────────────────────────────────────────────────────────────┐ │ LAYER 5: ROUTE-SPECIFIC │ │ ┌──────────────────────────────────────────────────────────┐ │ │ │ Aggressive Rate Limiter Middleware │ │ │ │ • Per-route limits (10-20 req/min) │ │ │ │ • Pattern detection │ │ │ │ • Suspicious activity scoring │ │ │ │ │ │ │ │ Scoring System: │ │ │ │ • Single-char search: +5 points │ │ │ │ • 2-char search: +2 points │ │ │ │ • High rate: +1 point │ │ │ │ • Block at: 20 points │ │ │ │ • Block duration: 30 minutes │ │ │ └──────────────────────────────────────────────────────────┘ │ │ ✅ PASS or ❌ 429 + BLOCK │ └────────────────────────┬────────────────────────────────────────┘ │ ▼ ┌─────────────────────────────────────────────────────────────────┐ │ LAYER 6: CONTROLLER │ │ ┌──────────────────────────────────────────────────────────┐ │ │ │ Input Validation │ │ │ │ • Minimum length: 2 characters │ │ │ │ • Sanitization: Remove special chars │ │ │ │ • Early return for invalid input │ │ │ └──────────────────────────────────────────────────────────┘ │ │ ✅ PASS or ❌ 400 │ └────────────────────────┬────────────────────────────────────────┘ │ ▼ ┌─────────────────────────────────────────────────────────────────┐ │ LAYER 7: DATABASE │ │ ┌──────────────────────────────────────────────────────────┐ │ │ │ Query Optimization │ │ │ │ • LIKE query with validated input │ │ │ │ • Index on name, barcode │ │ │ │ • LIMIT 20 results │ │ │ │ • WHERE qty > 0 (reduce result set) │ │ │ └──────────────────────────────────────────────────────────┘ │ │ ✅ RESULTS │ └────────────────────────┬────────────────────────────────────────┘ │ ▼ ┌─────────────────────────────────────────────────────────────────┐ │ RESPONSE TO CLIENT │ │ (JSON with products) │ └─────────────────────────────────────────────────────────────────┘ ``` --- ## Attack Flow (Before Security) ``` Attacker sends: /api/products/search?q=t │ ▼ Nginx passes │ ▼ PHP-FPM accepts │ ▼ Laravel: No validation │ ▼ Database: LIKE '%t%' (Searches ALL products) │ ▼ Takes 2-3 seconds │ ▼ Worker busy │ ▼ Attacker sends 100 requests/second │ ▼ All 5 workers exhausted │ ▼ SITE DOWN ❌ ``` --- ## Attack Flow (After Security) ``` Attacker sends: /api/products/search?q=t │ ▼ ┌────────────────────────┐ │ NGINX: 2 req/sec │ │ Request #3 → 429 ❌ │ └────────────────────────┘ │ ▼ (if passes) ┌────────────────────────┐ │ Laravel Global: │ │ 1200 req/min │ │ OK ✅ │ └────────────────────────┘ │ ▼ ┌────────────────────────┐ │ Aggressive Throttle: │ │ 10 req/min │ │ Request #11 → 429 ❌ │ └────────────────────────┘ │ ▼ (if passes) ┌────────────────────────┐ │ Pattern Detection: │ │ Single char = +5 │ │ Score: 5/20 │ │ OK ✅ │ └────────────────────────┘ │ ▼ ┌────────────────────────┐ │ Input Validation: │ │ Length < 2 │ │ Return error ❌ │ └────────────────────────┘ After 4 single-char attempts: ┌────────────────────────┐ │ Score: 20/20 │ │ AUTO-BLOCK 30 MIN ❌ │ └────────────────────────┘ ATTACK STOPPED ✅ Site remains available for legitimate users ✅ ``` --- ## Response Time Comparison ### Before Security (Under Attack) ``` Request #1: 200ms ✅ Request #2: 300ms ✅ Request #3: 500ms ⚠️ Request #4: 1000ms ⚠️ Request #5: 2000ms ⚠️ Request #6: TIMEOUT ❌ Request #7+: TIMEOUT ❌ ``` ### After Security (Under Attack) ``` Request #1: 200ms ✅ (nginx: 1ms, laravel: 199ms) Request #2: 200ms ✅ (nginx: 1ms, laravel: 199ms) Request #3: 1ms ❌ (nginx blocks, doesn't reach PHP) Request #4+: 1ms ❌ (nginx blocks, doesn't reach PHP) Legitimate users: 200ms ✅ (no impact) ``` --- ## Resource Usage ### Before Security (Under Attack) ``` PHP-FPM Workers: 5/5 busy (100%) ❌ CPU Usage: 95% ❌ Memory: 2GB/4GB ⚠️ Database Conns: 50/100 ⚠️ Response Time: Timeout ❌ ``` ### After Security (Under Attack) ``` PHP-FPM Workers: 1/5 busy (20%) ✅ CPU Usage: 15% ✅ Memory: 500MB/4GB ✅ Database Conns: 5/100 ✅ Response Time: 200ms ✅ (Attack blocked at nginx level) ``` --- ## Security Metrics ### Detection Speed - **Nginx**: < 1ms (fastest) - **Laravel Middleware**: 1-2ms - **Controller Validation**: 2-3ms - **Database Query**: 200-300ms (only if all pass) ### Block Duration - **Nginx rate limit**: 1 minute (automatic) - **Laravel rate limit**: 1 minute (automatic) - **Suspicious activity**: 30 minutes (automatic) - **Manual block**: Configurable (default 24 hours) ### Recovery Time - **Nginx reload**: < 1 second - **PHP-FPM restart**: 2-3 seconds - **Laravel cache clear**: 1-2 seconds - **Full deployment**: 30-60 seconds --- ## Monitoring Points ``` ┌─────────────────────────────────────────────────────────────────┐ │ MONITORING STACK │ ├─────────────────────────────────────────────────────────────────┤ │ │ │ 📊 Nginx Access Logs │ │ • Request rate per IP │ │ • 429 response count │ │ • Response times │ │ │ │ 📊 Laravel Logs │ │ • Suspicious activity scores │ │ • Auto-blocked IPs │ │ • Rate limit violations │ │ │ │ 📊 PHP-FPM Status │ │ • Worker availability │ │ • Queue length │ │ • Memory usage │ │ │ │ 📊 Database Slow Query Log │ │ • Queries > 1 second │ │ • Full table scans │ │ │ │ 📊 System Metrics │ │ • CPU usage │ │ • Memory usage │ │ • Network traffic │ │ │ └─────────────────────────────────────────────────────────────────┘ ``` --- ## Future Enhancements ### Phase 1 (Immediate - Done ✅) - [x] Nginx rate limiting - [x] Laravel aggressive throttle - [x] Input validation - [x] Pattern detection - [x] Auto-blocking ### Phase 2 (Next Week) - [ ] Cloudflare integration - [ ] fail2ban configuration - [ ] Automated alerts - [ ] CAPTCHA for repeated failures - [ ] Redis for rate limit storage ### Phase 3 (Next Month) - [ ] Machine learning for attack detection - [ ] Geo-blocking capabilities - [ ] Advanced analytics dashboard - [ ] Automated IP reputation checking - [ ] DDoS mitigation service --- **This architecture provides defense in depth with multiple independent layers that work together to protect against attacks while maintaining performance for legitimate users.**