The Cardinality Bomb: Defending APIs at the Edge Without an External Cache
How an edge reverse proxy uses fixed-memory sketches to survive infinite-cardinality attacks, credential abuse, and runaway agent loops. In Part 1 , we explored Interpreted Decay — calculating recency-weighted frequency on-the-fly at read time ( count >> age ) in a single 64-bit word. In Part 2 , we looked under the hood at atomic Compare-And-Swap (CAS) state transitions, bit-chipping eviction…
At the heart of the Cardinality Bomb problem lies an attack scenario where an automated scraper or credential-stuffing bot targets a public API behind an edge reverse proxy. The bot rapidly cycles through hundreds of thousands of residential IP addresses and randomized query paths to evade rate limiting measures. Traditional distributed rate limiting architectures using centralized Redis or Memcached clusters struggle under such high-cardinality floods.
The main operational trade-offs include memory and eviction collisions, added network latency, and connection pool exhaustion. The Cardinality Bomb problem manifests in two ways: firstly, no per-key rate limiter can effectively block requests from a 100% rotating key; secondly, the rate limiter itself becomes a target for the attacker.
Traditional rate limiters using in-memory hash maps or Redis clusters fail under the attack, as every new IP triggers heap allocation or key bloat, leading to OOM crashes. SketchProxy addresses this issue by employing fixed-memory edge defense. Instead of synchronizing state with an external cache cluster, each proxy instance maintains dedicated in-memory epochsketch tables.
These tables are allocated once at startup and never resize, ensuring flat and immutable memory consumption regardless of the number of requests or distinct IP addresses. SketchProxy's multi-layer request pipeline includes rate limiting and tarpit slow lane, as well as wallet defense to neutralize proxy-hopping bots. The tarpit slow lane introduces a two-tier volume band, dropping requests above a certain threshold and delaying those within a suspicious volume band.
Wallet defense tracks frequency based on the HTTP Authorization header, allowing the detection of scraper bots regardless of IP rotation. This approach enables SketchProxy to survive the rotation of thousands of IP addresses while enforcing limits on non-rotating clients without relying on external databases.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
