webapi-token-guard

Test WebApi token anti-bruteforce protections by running pytest integration tests against a live non-prod environment to verify rate-limiting behavior, Bloom precheck short-circuits, and X-Forwarded-For spoofing resistance.

Validating token authentication rate limiting requires WA_BASE_URL, WA_TOKEN_PATH, WA_USERNAME, WA_PASSWORD, and WA_APP_KEY as mandatory inputs, with optional burst and sleep parameters to control the test execution flow.

Pytest works for regression testing X-Forwarded-For spoofing resistance by executing integration tests that verify deployed WebApi guards remain effective at blocking header spoofing attempts after code changes.

Bloom precheck short-circuit validation in WebApi security testing checks whether the token endpoint efficiently rejects known bad requests early, preventing unnecessary processing and hardening the API against abusive traffic.

Running anti-bruteforce security checks against a production WebApi stand is not supported. The integration tests are designed exclusively for validating rate limiting and spoofing resistance on live non-prod environments.

Your WebApi token endpoint might fail to block spoofed X-Forwarded-For headers if rate limiting or IP validation guards are misconfigured. Run pytest integration tests to diagnose the resistance failure.