Skip to main content

API4:2023 Unrestricted Resource Consumption

An endpoint lets callers consume server CPU, memory, database time or downstream API quota without bound: no rate limit, unbounded query results, search without pagination, recursive GraphQL queries. One client can exhaust the service or run up your bill.

What Vulkro detects​

  • Routes with no rate-limiting middleware visible in the request pipeline.
  • List endpoints without pagination.
  • GraphQL schemas without depth or complexity limits.

Non-compliant code​

// Express: public POST endpoint with no rate limiter
app.post('/api/signup', async (req, res) => {
  await createUser(req.body);  // unbounded; a bot can flood it
  res.sendStatus(201);
});

Compliant code​

// Express: rate-limit middleware applied
const rateLimit = require('express-rate-limit');
const signupLimiter = rateLimit({ windowMs: 60_000, max: 5 });
app.post('/api/signup', signupLimiter, async (req, res) => {
  await createUser(req.body);
  res.sendStatus(201);
});

How to fix​

  • FastAPI: add slowapi, @limiter.limit("10/minute").
  • Express: app.use(rateLimit({ windowMs: 60_000, max: 30 })) from express-rate-limit.
  • Paginate list endpoints and cap page size.
  • Set depth and complexity limits on GraphQL servers.

References​

See also: Confidence model.

This page is generated by vulkro rules export <out-dir> from Vulkro's built-in detector catalogue. Edits made by hand are overwritten on the next regeneration.

Last updated on