Automated abuse of legitimate flows, such as buying up stock, creating accounts in bulk or spamming, harms the business even when every individual request is valid.
- Identify the business flows that would cause harm if automated, and decide how much automation is acceptable for each.
- Use device fingerprinting, human-detection challenges and behavior signals to slow or block non-human use.
- Protect the machine-facing APIs, such as B2B and developer endpoints, that can bypass those checks.
Guides on this site
Prevent business-logic flaws with server-side invariants
Recompute prices on the server, run workflows as state machines, build reset links from configuration, limit valuable flows, and turn each business rule into an invariant that the database and the tests both check.
Operate edge rules without hiding application defects
Tune WAF and abuse controls against legitimate traffic, parser behavior and measurable business effects.
Operate edge rules without hiding application defects
Tune WAF and abuse controls against legitimate traffic, parser behavior and measurable business effects.
Bound API work, not just request counts
Protect availability and operating cost with limits on input, per-request work, concurrency, queues, and downstream spending.
Practice
- Business logic lab: Price an order without trusting the client · Browser lab
- Repair a real proxy and shared cache · Local project
References
List data from the publisher. A guide is listed as the main subject when the weakness or risk is what the guide is about, and as covering it when a dedicated section or worked example addresses it.