Input and resource controls
Protect sensitive business flows
Defend high-value actions such as purchasing, invitations, reservations, and password reset from automation and logic abuse.
8 minute lesson
A perfectly valid request can still abuse the product. Buying all limited stock through automation is a business-flow attack.
Identify scarce, valuable, or irreversible actions. Add per-identity and contextual limits, idempotency, confirmation, monitoring, and manual review where impact warrants it. Avoid defenses that only slow honest users.
An invitation endpoint can pass every schema check while sending 10,000 emails. A CAPTCHA alone may slow bots, but it does not cap cost after a valid session is automated.
Limits need a recovery path for legitimate spikes. Record who can approve a larger campaign, how long the exception lasts, and which signal reveals continued abuse.
Set per-account and per-destination limits for invitations and record the expected email count. Replay requests across several sessions and prove delivery stops, an event is logged, and normal recovery remains possible.
Lesson completed