I don’t run an onion service myself but have been considering what could happen and what abuse mitigation might look like. I am fully aware of the proof-of-work security defenses (see Introducing Proof-of-Work Defense for Onion Services | The Tor Project) that are available for onion services, but there are other types of attacks beyond connection flooding, too.
Let’s say I have a denial of service attack at the application layer. In this case, it’s not just consuming a lot of connections to the onion service but consuming large amounts of resources on the server, such as requesting a lot of expensive search queries that are clearly malicious. And assume I know for certain that blocking this connection will not disrupt a real user or non-malicious bot. Clearweb systems can do something rudimentary like an IP ban, but onion services cannot.
I guess the documentation mentions rate limiting.
Is it possible for onion services to “kick” a misbehaving connection such that the connection has to re-perform proof of work in order to get a new connection slot? That way honest clients can get the slot. How can an onion service accomplish this? Is closing the circuit of the misbehaving connection (with stem, like controller.rs - source) the right approach?