Input and resource controls
Limit resource consumption
Bound request size, execution time, pagination, uploads, concurrency, and expensive downstream work before one caller can exhaust shared capacity.
8 minute lesson
An API can be valid and still be too expensive. Attackers look for operations where a small request creates large work.
Set limits at the edge and inside the application. Cap page size, query complexity, file size, processing time, retries, and concurrent jobs. Return a controlled response and observe repeated limit hits.
A 2 KB report request can trigger a minute-long database scan and a 200 MB export. One global rate limit misses this cost difference and may punish cheap requests.
Measure the expensive unit directly: rows scanned, worker seconds, memory, or provider calls. Per-operation budgets make the limit explainable and let ordinary invoice reads keep working.
Measure database time, response bytes, and queued work for the report endpoint. Exceed one page, timeout, and concurrency limit, then prove the API fails predictably while a normal request still succeeds.
Lesson completed