API4:2023Unrestricted Resource Consumption
Slide 8 of 28
Part 1 · What Is It?Slide 8
Slide 8 · Why It's #4
It applies to every endpoint, not just sensitive ones.
Missing limits have no minimum severity — they scale with the attacker's ambition.
The Scope Problem

API1 through API3 affect specific endpoints — the ones that expose or modify data based on identity or authorization. API4 applies to every single endpoint in your API. A public search endpoint with no rate limit is as dangerous as an authenticated endpoint with no rate limit. Any operation the server performs on behalf of a client can be weaponized by calling it at volume.

Why it's pervasive
Rate limiting is infrastructure — often treated as an ops concern, not a dev concern
Most frameworks don't include rate limiting by default
Teams add it after the first incident, not before
Different limits needed per endpoint — one-size-fits-all fails
Why severity is unbounded
Scraping: damage scales with dataset size — can affect millions of records
Cost amplification: bill scales with attacker's script runtime
DoS: can take the entire API offline for all users
Brute force: unlimited attempts make any credential breakable
← Back Show me how it works →
📄 View sources