Right, and who decides that a request coming from a customer ot an attacker? If the attacker can generate enough requests non of the customers have a chance to use your service. This is absolutely not the way to handle DDoS.

My point was that it's a sensible strategy for the demo of a technology that's still under development (like this project), where you don't actually have any "customers." In production, you'd let it scale unboundedly, and combine it with some sort of anti-DDoS technology like Cloudflare.