Back to Guides

    API4:2023 - Unrestricted Resource Consumption

    Missing limits on requests and workloads allows cost abuse and denial of service.

    Why This Category Exists

    APIs can expose expensive queries, large payload handling, and CPU-intensive operations. Without limits and quotas, attackers or buggy clients can exhaust compute, memory, and database capacity.

    Common Impact

    • Service degradation and outage.
    • Unexpected cloud cost spikes.
    • Noisy-neighbor impact across tenants.

    Prevention Checklist

    • Apply rate limits per user, IP, token, and tenant.
    • Enforce payload, page size, and execution time limits.
    • Use quotas, circuit breakers, and backpressure patterns.
    • Track abusive patterns with alerting and automated mitigation.