API4:2023 Unrestricted Resource Consumption

What API4:2023 Unrestricted Resource Consumption requires

OWASP API Security Top 10 (2023) API4:2023 Unrestricted Resource Consumption. Satisfying API requests requires resources such as network bandwidth, CPU, memory, and storage. Sometimes required resources are made available by service providers via API integrations, and paid for per request, such as sending emails/SMS/phone calls, biometrics validation, etc. An API is vulnerable if at least one of the following limits is missing or set inappropriately (e.g. too low/high): * Execution timeouts * Maximum allocable memory * Maximum number of file descriptors * Maximum number of processes * Maximum upload file size * Number of operations to perform in a single API client request (e.g. GraphQL batching) * Number of records per page to return in a single request-response * Third-party service providers' spending limit This category sits within the OWASP API Security Top 10 (2023 edition), the canonical industry list of the ten most critical API security risks. Organizations implementing API services should treat each of the ten categories as both a design constraint and a continuous-monitoring obligation, with policies, automated testing, and incident response procedures defined per category.

Pillar: Cybersecurity · Authority: OWASP Foundation (Open Worldwide Application Security Project) · Version: 1.0.0 · Last updated: 2023-06-13

Primary source: https://owasp.org/API-Security/editions/2023/en/0xa4-unrestricted-resource-consumption/

SHA-256 integrity: 63e31193f658559b655469dd3c189b631ec5ae1c20245ed00f83d8c0fd8be01c

Primary Citations — 12 traced to source

• OWASP API Security Top 10 (2023), API04:2023 Unrestricted Resource Consumption, How To Prevent: 'Use a solution that makes it easy to limit [memory][1], [CPU][2], [number of restarts][3], [file descriptors, and processes][4] such as Containers / Serverless code (e.g. Lambdas).'
• OWASP API Security Top 10 (2023), API04:2023 Unrestricted Resource Consumption, How To Prevent: 'Define and enforce a maximum size of data on all incoming parameters and payloads, such as maximum length for strings, maximum number of elements in arrays, and maximum upload file size (regardless of whether it is stored locally or in cloud storage).'

+ 10 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.

Access

• Discovery (free): /api/v1/nodes/owasp-api-top-10-2023-api04-unrestricted-resource-consumption.json — 6-field metadata
• Vault (full node): /api/v1/vault/nodes/owasp-api-top-10-2023-api04-unrestricted-resource-consumption.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
• Canonical URL: https://bidda.com/intelligence/owasp-api-top-10-2023-api04-unrestricted-resource-consumption
• Back to registry: Browse all 10,090 compliance nodes