Rate limiting and denial-of-service protection
Without rate limits, attackers can try thousands of passwords, scrape all your data or overload expensive endpoints. Rate limiting and resource limits are basic protections that many APIs still lack.
How it happens
An endpoint accepts unlimited requests, a regular expression takes exponential time on crafted input, or an XML parser expands nested entities. Each lets a single client consume far more than its share of resources.
Why it matters
- Brute-force and credential-stuffing attacks.
- Service slowdowns or outages.
- Higher infrastructure bills.
How to prevent it
- Apply rate limits per user, per IP address and per endpoint, especially for login and search.
- Set limits on request size, pagination and query complexity.
- Avoid regular expressions that are vulnerable to catastrophic backtracking.
- Disable XML external entities and entity expansion.
How Vooki Pro helps
- Checks for missing rate limiting, regular-expression denial of service (ReDoS), XML bombs and resource exhaustion.
- Alerts you when your own scan hits HTTP 429 rate limits, so you can tune throttling.
- Lets you throttle the request rate of every scan.
- Production Safe (Passive) mode sends only non-intrusive requests when you need to scan live systems gently.
Frequently asked questions
Where should I apply rate limits?
On login, password reset, search, and any expensive or data-heavy endpoint, per user and per IP address.
What is ReDoS?
Regular-expression denial of service: a crafted input makes a vulnerable regex take exponential time, tying up the server.
Try Vooki Pro free for 7 days
Find missing rate limits without taking your site down. The trial unlocks every feature for 7 days, and scanning runs on your own machine.
Related: Protecting against clickjacking · Subresource Integrity and third-party scripts