OWASP API Security

OWASP API Security Project description ... ]} **Scenario #3** GET /api/products/ HTTP/1.1Host: example.comX-API-Key: A5B52F6945BB6A2DAD6CD52A4B196 **Exploit** An attacker could issue millions of requests per minute to overload the API and impact its availability to legitimate users. This could also incur extra cost if the API is billed per request. **Prevention** * Define proper rate limiting. * Load testing to understand the service limit and establish alerts and thresholds. * Define and enforce a maximum size of data on all incoming parameters, such as maximum length for strings and maximum number of elements in arrays.<!--KaTeX--> Customers are allowed to perform a certain number of requests per minute. Consider limiting the number of records a user can request per call (page size) to prevent fetching a whole database (as described in **BOLA**). [OWASP API Security Cheat Sheet#523](https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html#limit-rate) **Pagination** Limit the number of records returned in a response if the backend doesn’t have a restriction already. For example: **Request** GET /api/products?page=1&pageSize=10 HTTP/1.1Host: example.com **Response** HTTP/1.1 200 OKContent-Type: application/json{