Rate limiting
Bounding how many requests a client, account, key or address may make in a period, to slow guessing and scraping and to protect capacity and cost (OWASP API4:2023). Key the limit to the resource at risk, such as the target account for login attempts, not only to the source IP address.
- Also called
- rate limit
- Identifiers
- API4:2023 Unrestricted Resource Consumption
Covered in
Bound API work, not just request counts
Protect availability and operating cost with limits on input, per-request work, concurrency, queues, and downstream spending.
Keep HTTP services up under application-layer DDoS
Bound every phase of an HTTP request, patch for the HTTP/2 attack classes, rate limit at the edge and the origin, and shed load deliberately, with nginx, Envoy and Node.js settings tested against slow clients and bursts.
Apply security limits to GraphQL, WebSocket and gRPC operations
Carry authorization and resource budgets past the initial HTTP request into resolvers, messages and long-lived streams.
Contain cascading failures and rogue agents
Stop a looping, compromised or drifting agent from spreading harm: kill switches, budget and rate limits, circuit breakers, behavior monitoring, blast-radius limits, quarantine, rollback and incident response, all enforced outside the agent.
Bound background jobs and make retries safe
Keep queues, workers and paid dependencies within a defined budget when clients retry, cancel or disappear.
Design a safer file-upload pipeline
Treat upload receipt, content processing, storage, and later delivery as separate security decisions.
All 11 pages that cover Rate limiting in the library
Practice: Path traversal lab: Serve an uploaded file without path traversal · File upload lab: Accept avatars without publishing pages · Local project: Keep extracted files inside their boundary · Local project: Repair a real proxy and shared cache