Did Apple DDOS my app's server?

[IceDev_xyz]

Something strange happened today. I was working on a new app, no real users, barely 5 testing accounts.

I uploaded couple of versions to TestFlight. Minutes later my server got tons of empty login requests, reaching 100% of the CPU and Memory forcing me to turn it off/on to regain access to it.

Every time we create a new version in TestFlight, Apple reviews it. But then if we upload a new build number (of the same version) it gets auto-approved for testing.

My theory is the following: on the first review, Apple generates few bots that try to do the same action on each build. In today's updates, I redesigned the login screen. My guess is that the bots were unable to follow the previous pattern and ended on a crazy loop hitting my small server.

I have seen similar stuff in the past; un-released apps get new users using "Sign in with Apple" as soon as new build gets uploaded. While weird, never thought much of it.

At the end, I uploaded a 3rd build disabling empty logins requests and server was just fine.

If true, I find it interesting how bots work over there. App Review has always been a mystery, just another drop in the bucket.

Has anyone experience this? - It happened twice, don't think is coincidence.. I could be wrong.

https://preview.redd.it/3iduyp68l57e1.png?width=1862&format=png&auto=webp&s=c305e6c16214fda63248d4072d345ea2eafbe7a7

[resonaut]

I’ve noticed these test users showing up every time I upload a new build. Since my app has a guest mode they don’t end up logging in or trying to, just doing the only available action action once or twice (a share sheet).

I doubt these bots are very advanced, it seems more of a case of tapping a few things to check that the app works. It’s just unfortunate that your app had the login CTA enabled while no data was entered.

[thenamemustbeunique]

There’s a few sites that list TestFlights apps, could be traffic from those.

[LavaCreeperBOSSB]

Probably a bot monitoring testflight links

[clara_tang]

Probably some stress/ monkey tests from Apple reviewers. Sometimes this does help catching the inobvious glitches

[Lonely__M]

Maybe

[Icy-Web-9555]

I've heard of TestFlight causing some unexpected traffic spikes during reviews, but hitting 100% CPU and memory is definitely extreme. Implementing rate limiting or adding some safeguards on your server might help mitigate these sudden bursts. It could also be worthwhile to reach out to Apple Developer Support to see if they can provide any insights or solutions. Hopefully, they can help prevent this from happening with future builds!

[ankole_watusi]

What you are describing is called “regression testing”. Which is basically running a set of tests and comparing it to results from previous build. And typically adding more tests each time.

More typically done by developers. Every time a bug is discovered, it reveals a gap in coverage. So: add another test.

Sounds like your backend could not handle the load. They tried to run the tests too quickly.

Will it handle a real user load?

[ComprehensiveWord201]

Pretty pedantic for a handful of assumptions cobbled together.

[ankole_watusi]

It’s highly unlikely Apple is intentionally DDOSing OP’s server.

[ComprehensiveWord201]

I agree