owasp-rate-limit-retry-after
Ensure that any 429 response, contains a Retry-After header.
Define proper rate limiting to avoid attackers overloading the API. Part of that involves setting a Retry-After header so well meaning consumers are not polling and potentially exacerbating problems
Bad example
openapi: 3.1.0
info:
version: 1.0.1
paths:
/:
get:
responses:
"429":
description: ok
headers:
"200":
description: ok
headers:
"Retry-After":
description: standard retry header
schema:
type: string
Good Example
openapi: "3.1.0"
info:
version: 1.0
paths:
/cakes:
get:
responses:
"429":
description: OK
headers:
"Retry-After":
description: standard retry header
schema:
type: string`
How do I fix this violation?
Set the Retry-After header in the 429 response.