Resource Limitation: Missing Rate Limiting¶

Identifier: missing_rate_limiting

Scanner(s) Support¶

Description¶

Missing rate limiting occurs when applications do not restrict repeated requests to sensitive or expensive operations, allowing abuse through brute force, scraping, or resource exhaustion.

How we test: We send repeated requests to candidate endpoints and analyze whether the application enforces throttling, quotas, lockouts, or other controls that limit abusive request rates.

References:

• https://owasp.org/API-Security/editions/2023/en/0xa4-unrestricted-resource-consumption/
• https://cwe.mitre.org/data/definitions/770.html

Configuration¶

Example¶

Example configuration:

---
security_tests:
  missing_rate_limiting:
    skip: false

Reference¶

skip¶

Type : boolean

Skip the test if true.