Implement Rate Limit Feature - Sreejith #38
Conversation
|
Add ResourcesAndRateLimitingTestCase for OWASP API4:2023 Implements automated testing for Unrestricted Resource Consumption (API4:2023) according to the OWASP API Security Top 10 2023. This test case detects:
Each vulnerability is reported with severity rating and remediation guidance. |
| } | ||
|
|
||
| try { | ||
| String fullUrl = "https://example.com" + endpoint.getPath(); |
There was a problem hiding this comment.
The fullUrl variable is hardcoded with "https://example.com". This should be replaced with a mechanism to use the target URL from the scan configuration.
| long responseTime = endTime - startTime; | ||
|
|
||
| // If the response time is very high, it might indicate an expensive operation | ||
| if (responseTime > 5000) { |
There was a problem hiding this comment.
The search test uses a fixed response time threshold (5 seconds). This could be made configurable or adjusted based on typical API response times.
| private static final Logger logger = LogManager.getLogger(ResourcesAndRateLimitingTestCase.class); | ||
|
|
||
| // Thresholds for testing | ||
| private static final int RATE_LIMIT_TEST_REQUESTS = 20; |
There was a problem hiding this comment.
These hard coding part, we need to see how we can make it configurable
2 participants
No description provided.