zakirkun Missing API Rate Limiting
Overview
APIs without rate limiting are vulnerable to:
- Credential stuffing: Automated login attempts with breached credentials
- Resource exhaustion: Expensive computation triggered repeatedly (DoS)
- Data harvesting: Scraping all records via automated enumeration
- OTP brute force: Guessing 6-digit codes in 1,000,000 requests
Detection Strategy
Identify API endpoints handling authentication, password reset, OTP verification, or resource-intensive operations that lack rate limiting middleware.
Remediation
Apply rate limiting at the API gateway or application level with per-IP or per-user quotas.