owasp-rate-limit
Define proper rate limiting to avoid attackers overloading an API operation.
vacuum applies the following header patters by default:
- X-RateLimit-Limit
- X-Rate-Limit-Limit
- RateLimit-Limit
- RateLimit-Reset
Bad example
openapi: 3.1.0
info:
version: 1.0
paths:
/chicken/nuggets:
get:
description: get
responses:
"201":
description: "ok"
headers:
"SomethingElse":
schema:
type: string
Good Example
openapi: 3.1.0
info:
version: 1.0
paths:
/:
get:
responses:
"201":
description: ok
headers:
"X-RateLimit-Limit":
schema:
type: string
"X-RateLimit-Reset":
schema:
type: string`
How do I fix this violation?
Implement rate-limiting using HTTP headers: https://datatracker.ietf.org/doc/draft-ietf-httpapi-ratelimit-headers/
Use headers like X-Rate-Limit-Limit https://developer.twitter.com/en/docs/twitter-api/rate-limits
or X-RateLimit-Limit https://docs.github.com/en/rest/overview/resources-in-the-rest-api