Security Test: Response size¶

Description¶

Default Severity: low

Sometimes an application ends up sending back a much larger response than intended, which can put a strain on both the server and the client. This happens when inputs aren't properly validated or when there’s no limit on how much data the server is allowed to return. It can slow down or even crash systems and open the door to denial of service attacks, where attackers intentionally trigger these oversized responses to overwhelm your resources. Developers often fall into the trap of assuming that just because they're returning data, bigger is better, without putting in place controls to check response sizes or detect unusual activity. This oversight can lead to unexpected system behavior and makes it easier for attackers to disrupt your services.

Configuration¶

Identifier: resource_limitation/response_size

Examples¶

All configuration available:

checks:
  resource_limitation/response_size:
    skip: false # default
    options:
      threshold: 10485760 # default

Options¶

Options can be set in the options key of the Security Test Configuration.

Compliance and Standards¶