title: How to leave client waiting for Java JAX-RS service to prevent DOS
body: <p>I'm having an issue with a web service with users trying to guess application IDs by looping over random IDs.</p>
  
  <p>The bad requests are coming from random IPs, so I cannot just ban their IP (unless I do it dynamically, but I'm not looking into that yet).</p>
  
  <p>Currently when I detect a client that has made 10 bad app ID attempts I put them on a block list in my app, and reject further requests from that IP for the day.</p>
  
  <p>I want to minimize the amount of work my server needs to do, as the bad client will continue to send 1000s of requests even though they get rejected.  I know there are dynamic Firewall solutions, but want something easy to implement in my app for now.  Currently I am sleeping for 5 seconds to reduce the calls, but what I want to do is just not send a response to the client, so it has to timeout.</p>
  
  <p>Anyone know how to do this in Java, in JAX-RS?</p>
  
  <p>My service is like,</p>
  
  <pre><code>@Path("/api")
  public class MyServer {
  
  @GET
  @Consumes(MediaType.APPLICATION_XML)
  @Produces(MediaType.APPLICATION_XML)
  @Path("/my-request")
  public String myRequest(String type,
      @Context HttpServletRequest requestContext,
      @Context HttpServletResponse response) {
  ...
  }
  </code></pre>
  
  <p>See:
  <a href="https://stackoverflow.com/questions/32575924/how-to-stop-hack-dos-attack-on-web-api">How to stop hack/DOS attack on web API</a></p>