Slide 28 of 28
CompleteSlide 28
Module Complete
You finished API4 — Unrestricted Resource Consumption. Here's what you now understand:
What the risk is — APIs with no limits on frequency, size, or cost can be consumed without bound
Three damage modes: bulk data scraping, denial of service, and cloud cost amplification
How it differs from DDoS — valid requests, one client, no network-layer filter helps
Real incidents — Venmo 207M transactions (no rate limit) and Twitter 5.4M account-phone pairs (no lookup rate limit)
OWASP scenarios — unbounded pagination DoS, AI cost amplification, SMS OTP flooding
Seven mitigations: rate limiting, max page size, payload limits, timeouts, GraphQL complexity, cost quotas, and anomaly monitoring
The one thing to carry forward

Every API endpoint is implicitly a promise: "send me a request and I'll do work on your behalf." Without limits, that promise has no upper bound. Rate limits, size caps, and cost quotas are how you define what "too much" means — before an attacker defines it for you.

← Back to Quiz Next: API5 — Broken Function Level Authorization →