If DDoS bot is able to process cookies and do redirects sent by sticky cookie, then JavaScript is useful to challenge a bot. So http_sticky module should be extended to http_challenge module which should implement JavaScript challenge as well.
The module shall do basically the same as sticky cookie, but using JavaScript instead of HTTP redirects: send 200 response with HTML document containing JavaScript code which sets encrypted/hashed Cookie and requests the same URI.
There is reference implementation by @kyprizel.
There is a good discussion about PhantomJS detection, but all the methods aren't infalliable,
If DDoS bot is able to process cookies and do redirects sent by sticky cookie, then JavaScript is useful to challenge a bot. So
http_stickymodule should be extended tohttp_challengemodule which should implement JavaScript challenge as well.The module shall do basically the same as sticky cookie, but using JavaScript instead of HTTP redirects: send 200 response with HTML document containing JavaScript code which sets encrypted/hashed Cookie and requests the same URI.
There is reference implementation by @kyprizel.
There is a good discussion about PhantomJS detection, but all the methods aren't infalliable,