A pagination attack abuses unconstrained collection parameters to make an API return or process excessive data. For example, an attacker can request millions of items in one call, overwhelming servers and threatening performance or availability. section 12.2
Unbounded course requests
The GET /courses endpoint uses page and per_page parameters. If the API specification sets no minimum or maximum values, an attacker can submit extreme values and request millions of courses at once. A related risk occurs when a course response returns an unbounded lessons array; a malicious actor could create a course with many lessons and force expensive responses. section 12.2 section 12.2
Reduce the attack surface by:
- Setting minimum and maximum boundaries for pagination parameters such as page and per_page. section 12.2
- Paginating large collections, including nested read-only collections when returning everything could pressure server performance. section 12.2
- Reviewing API specification detections and using observability to detect and prevent threats in real time. section 12.2
93:22 error owasp:api4:2023-integer-limit Schema of type integer must specify minimum and maximum. paths./courses.get.parameters[0].schema
Spectral flags the GET /courses page parameter because its integer schema lacks minimum and maximum constraints. section 12.2
