ZTLayer Logo
Start Building

Security Tutorials

Learn how to leverage ZTLayer's Rules Engine and Behavioral AI to solve specific, real-world security challenges in your application.

1. Blocking Credential Stuffing (Login Abuse)

Credential stuffing attacks use stolen username/password pairs obtained from third-party breaches to brute-force your login endpoints. Because these requests often come from thousands of different residential proxies, standard rate-limiting by IP address is ineffective.

The Solution: Behavioral Analysis

ZTLayer differentiates between a human typing a password and a Python script automating a headless browser by analyzing interaction telemetry.

Step-by-step:

  1. Navigate to Rules Engine in the ZTLayer Dashboard.
  2. Click Create Custom Rule.
  3. Set the Rule Name to Protect Login API.
  4. Define the filter expression:
    • http.request.uri.path == "/api/auth/login"
    • AND http.request.method == "POST"
  5. Set the Action to Challenge (Managed).
  6. Enable the Strict Behavioral AI toggle.

Expected Result: Legitimate users will not notice a difference. Automated bots failing the telemetry checks will be presented with a cryptographic challenge or CAPTCHA that headless scripts cannot solve.

2. Mitigating Volumetric Layer 7 DDoS

A Layer 7 DDoS attack attempts to overwhelm your backend database by sending millions of complex search queries or dynamic page requests.

The Solution: Edge Rate Limiting + Threat Intelligence

Stop the requests at the ZTLayer Edge before they reach your Vercel or AWS instances.

Step-by-step:

  1. Navigate to Rate Limits.
  2. Create a global limit: 200 requests / 1 minute per IP.
  3. Navigate to Rules Engine.
  4. Create a rule: Block High Risk IPs.
  5. Define the filter: cf.threat_score > 40 (If a user's IP has recently participated in a known botnet).
  6. Set the Action to Block.

Expected Result: Traffic spikes from known botnets are dropped at the network edge with a 403 Forbidden. Requests from clean IPs that exceed the rate limit are dropped with a 429 Too Many Requests. Your database remains stable.

3. Geo-Fencing an Admin Portal

Your internal administration dashboard (/admin) should not be accessible to the public internet, or at least restricted to countries where your employees reside.

The Solution: IP and ASN Restrictions

Step-by-step:

  1. Navigate to Rules Engine.
  2. Create a rule: Lockdown Admin Portal.
  3. Define the filter using the NOT operator:
    • http.request.uri.path contains "/admin"
    • AND NOT (ip.geoip.country in {"US", "UK", "CA"})
  4. Set the Action to Block.

Advanced Setup (Zero Trust): Instead of country codes, you can restrict access strictly to your corporate VPN's ASN (Autonomous System Number) or a specific static IP block:

  • http.request.uri.path contains "/admin"
  • AND ip.src.asn != 12345

Expected Result: Any attempt to access /admin from an unauthorized geographical location or non-corporate network will immediately return a 403 Forbidden.

Next Steps

  • CLI Documentation: Automate the deployment of these rulesets using ztlayer rules sync.
  • SDK Setup: Ensure your application is properly connected to the Edge to enforce these rules.