Unrestricted resource consumption includes compute, memory, database throughput, and paid dependency usage without guardrails. Attackers trigger expensive operations repeatedly to cause outages or financial abuse. The threat includes both deliberate abuse and accidental misuse from clients lacking usage discipline.
Apply quotas and budget controls at identity, tenant, and endpoint levels. Constrain expensive operations through async job queues, strict pagination, execution timeouts, and concurrency limits. Monitor cost and capacity telemetry continuously, and automate protections when thresholds are exceeded.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
2023Latest
#04api04-2023 Unrestricted Resource Consumption
