Unrestricted resource consumption occurs when an attacker can make an API or its infrastructure consume resources without effective limits. Concurrent requests can exhaust capacity, interrupt services, increase cloud costs, or support credential-guessing attacks. section 5.1 section 5.1.1
Figure 5.1 Unrestricted resource consumption happens when threat actors get unfettered access to our servers. In this example, a threat actor launches a DDoS attack from three servers.
A distributed denial-of-service attack uses multiple servers to send concurrent requests and exhaust the target’s resources. section 5.1
The risk extends beyond downtime. Serverless platforms can scale automatically during an attack, turning millions of requests or expensive operations into a denial-of-wallet attack. Unrestricted attempts can also enable brute-force account takeover. section 5.1.1
Reduce exposure with controls that reflect each endpoint’s risk and normal usage:
- Monitor and track requests, then throttle or ban consumers showing unusual or malicious patterns. section 5.9
- Apply strict rate limits to computationally intensive or data-sensitive endpoints, while using more relaxed limits elsewhere to preserve user flows. section 5.1.1
- Set reasonable thresholds with stakeholders, especially for serverless workloads whose uncontrolled scaling can create financial harm. section 5.1.1
An e-commerce request flow
If purchasing an item requires 10 API calls, blocking a user after eight calls can break a legitimate purchase. Protect expensive or sensitive operations strictly, but avoid applying one blanket policy to every endpoint. section 5.1.1
