title: Spring Boot 2 with Bucket4j to prevent DDOS Attacks
body: <p>I would like to prevent DDOS attacks on my spring boot 2 web application and I came across the framework <code>bucket4j</code> (<a href="https://github.com/MarcGiffing/bucket4j-spring-boot-starter" rel="noreferrer">bucket4j-github</a>). My application will run on heroku, and there they suggested doing so (<a href="https://devcenter.heroku.com/articles/preparing-a-spring-boot-app-for-production-on-heroku#rate-limit-api-calls" rel="noreferrer">Heroku-Link</a>)</p>
  
  <p>So far so good. I am now trying to implement <code>bucket4j</code> and I would expect after that, in case I press <code>F5</code> very fast and frequent, something would happen, an error will occure or something like that. But it behaves as it would without the <code>bucket4j</code> framework, the request has been all answered.</p>
  
  <p>My target is to limit the rate from an ip. Currently I just tried from localhost.</p>
  
  <p>What I have so far:</p>
  
  <p><strong>pom.xml</strong></p>
  
  <pre><code>    &lt;dependency&gt;
          &lt;groupId&gt;com.giffing.bucket4j.spring.boot.starter&lt;/groupId&gt;
          &lt;artifactId&gt;bucket4j-spring-boot-starter&lt;/artifactId&gt;
          &lt;version&gt;0.1.15&lt;/version&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
          &lt;artifactId&gt;spring-boot-starter-cache&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;
          &lt;groupId&gt;org.ehcache&lt;/groupId&gt;
          &lt;artifactId&gt;ehcache&lt;/artifactId&gt;
      &lt;/dependency&gt;
      &lt;dependency&gt;&lt;!-- Somehow I needed that since bucket4j--&gt; 
          &lt;groupId&gt;javax.interceptor&lt;/groupId&gt;
          &lt;artifactId&gt;javax.interceptor-api&lt;/artifactId&gt;
          &lt;version&gt;1.2.2&lt;/version&gt;
      &lt;/dependency&gt;
  </code></pre>
  
  <p><strong>application.properties</strong></p>
  
  <pre><code># CACHE
  spring.cache.jcache.config=classpath:ehcache.xml
  
  # RATE LIMIT
  bucket4j.enabled=true
  bucket4j.filters[0].cache-name=buckets
  bucket4j.filters[0].filter-method=servlet
  bucket4j.filters[0].url=/* 
  bucket4j.filters[0].rate-limits[0].bandwidths[0].capacity=10
  bucket4j.filters[0].rate-limits[0].bandwidths[0].time=1
  bucket4j.filters[0].rate-limits[0].bandwidths[0].unit=minutes
  bucket4j.filters[0].rate-limits[0].expression=getRemoteAddress()
  bucket4j.filters[0].rate-limits[0].bandwidths[0].fixed-refill-interval=0
  bucket4j.filters[0].rate-limits[0].bandwidths[0].fixed-refill-interval-unit=minutes
  </code></pre>
  
  <p><strong>ehcache.xml</strong></p>
  
  <pre><code>&lt;config ... &gt;
      &lt;cache alias="buckets"&gt;
          &lt;expiry&gt;&lt;ttl unit="seconds"&gt;3600&lt;/ttl&gt;&lt;/expiry&gt;
          &lt;heap unit="entries"&gt;1000000&lt;/heap&gt;
      &lt;/cache&gt;
  &lt;/config&gt;
  </code></pre>
  
  <p>What am I missing, or did I missunderstand the framework? Thanks for hints.</p>