Lack of Rate Limiting

Without the use of rate limiting, an adversary can make numerous repetitive requests and quickly deplete the available resources. This can result in denial of service or large-scale information leakage.

Remediation

Considering the business context of the program, implement a rate limit on every exposed endpoint (e.g., REST, GraphQL, etc.).

Metadata

Severity: low
Slug: lack-of-rate-limiting

CWEs

770: Allocation of Resources Without Limits or Throttling
400: Uncontrolled Resource Consumption

OWASP

A05:2021: Security Misconfiguration

Available Labs

Select a language to explore available labs for this vulnerability.

1 Lab

Csharp Labs

Csharp 1 lab

Explore 1 lab in Csharp.

1 Lab

Go Labs

Go 1 lab

Explore 1 lab in Go.

1 Lab

Java Labs

Java 1 lab

Explore 1 lab in Java.

1 Lab

Javascript Labs

Javascript 1 lab

Explore 1 lab in Javascript.

1 Lab

Php Labs

Php 1 lab

Explore 1 lab in Php.

1 Lab

Python Labs

Python 1 lab

Explore 1 lab in Python.

1 Lab

Ruby Labs

Ruby 1 lab

Explore 1 lab in Ruby.

2 Labs

Typescript Labs

Typescript 2 labs

Explore 2 labs in Typescript.

No matching labs found

Try adjusting your language filter.

Play AppSec WarGames

Want to skill-up in secure coding and AppSec? Try SecDim Wargames to learn how to find, hack and fix security vulnerabilities inspired by real-world incidents.

For Companies Play Now

Got a comment?

Join our secure coding and AppSec community. A discussion board to share and discuss all aspects of secure programming, AppSec, DevSecOps, fuzzing, cloudsec, AIsec code review, and more.