Rate Limiting, Anti-Automation and API Abuse
Rate limiting is the boring defense that prevents the unsubtle attacks: credential stuffing, OTP brute-force, scraping, business-logic abuse. It is also the defense most APIs implement once and forget about — which means the limits are wrong in subtle ways, missing for the endpoints that matter, or trivially bypassable.
APIs · By Thimmagurudu Bathini · Published · 5 min read · Last reviewed
Endpoints where missing rate limit hurts most
- Login — credential stuffing trivial without a limit
- Password reset and email confirmation — OTP brute force, account enumeration
- Signup — fake account creation, captcha bypass
- Search and filter — scraping the user, product, or pricing database
- Webhook delivery endpoints — DOS via replay
- Any endpoint with an expensive backend cost — report generation, export, AI calls
Where rate limit is usually wrong
Per-IP only: residential proxy services give attackers thousands of IPs cheaply. Per-IP-plus-per-account-plus-per-endpoint is the right grain. In-process counters: load-balanced behind multiple app servers means the limit is N× higher than intended. Reset on bypass: rate-limit headers tell the attacker exactly when to retry.
Beyond rate limits — anti-automation
For high-value endpoints, rate limits are necessary but insufficient. CAPTCHA on signup and password reset (with care — accessibility, bypass markets), device fingerprinting, anomaly detection on behavioral patterns. The goal is not zero abuse, it is to raise the attacker's per-request cost above the per-request value of the abuse.
What we test
We send bursts of parallel requests to every authenticated endpoint and to every interesting unauthenticated one. We replay successful requests from different IPs. We check rate-limit headers for predictability and look for ways to reset them. See API security testing.
Written by Thimmagurudu Bathini, BERRY9 IT SERVICES PRIVATE LIMITED, Hyderabad. Questions about your own systems? Request a scoping call or call +91 86868 92922.
Plan your next security test
Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.
- +91 86868 92922
- contact@berry9.com
- H.No: 8-3-945/A/12 & 13, Sri Venkata Sai Nest Apartments, Nagarjuna Nagar Colony, Yellareddyguda, Hyderabad 500073, Telangana