OWASP API Security Top 10 - 2023
Resource and Business Flow Protection

OWASP API Security Top 10 - 2023 OWASPAPI-4: Unrestricted Resource Consumption and Sensitive Business Flows

Address API4:2023 Unrestricted Resource Consumption + API6:2023 Unrestricted Access to Sensitive Business Flows per OWASP API Security Top 10 2023. Unrestricted Resource Consumption occurs when APIs do not limit CPU + memory + network + disk + database + or external API consumption by clients allowing DoS or cost amplification attacks. Unrestricted Access to Sensitive Business Flows occurs when APIs expose business workflows (account creation + ticket purchase + comment posting + transaction approval) to abuse via automation + scraping + scalping + fake review generation. Mitigations include (a) implement rate limiting at gateway + service layers per endpoint per client + (b) implement quota management for resource-intensive operations, (c) bot management for sensitive business flows including CAPTCHA + device fingerprinting + behavioural analysis + (d) cost controls for expensive operations (compute + database + external API), (e) timeout enforcement + circuit breakers + bulkheads.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.