When APIs lack hard limits on requests, payload size, concurrency, and backend cost, attackers can trigger denial-of-service and resource exhaustion. Abuse may target CPU-heavy search routes, file uploads, expensive third-party calls, or high-cardinality filters. Even non-malicious traffic spikes can degrade availability when quota policies are missing.
Implement layered controls: per-user and per-IP rate limits, request quotas, payload caps, pagination limits, timeout boundaries, and circuit breakers for downstream dependencies. Isolate expensive operations with queues and budgets. Monitor saturation metrics and block clients that repeatedly exceed safe usage thresholds.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
2019Latest
#04api04-2019 Lack of Resources and Rate Limiting
