OWASP API4:2023 · CWE-770 / CWE-307 · Resource Quota Verifier
Rate Limiting, Pagination Caps & GraphQL Depth Verifier
Uses safe, low-volume calibration probes (15 requests max) and static decorator checks to verify throttling policies without causing service disruption.
POST /api/v2/auth/login
Expected Policy: 5 req / min / IP + username
Observed Headers: None (Missing X-RateLimit-Remaining)
Calibration Trace: 15/15 calibration requests returned HTTP 200/401 (0 throttled)
GET /api/v2/users
Expected Policy: Max pagination limit <= 100
Observed Headers: X-RateLimit-Limit: 120, Page-Cap: 100
Calibration Trace: ?limit=5000 clamped to 100 items (HTTP 422 on >100)
POST /api/graphql
Expected Policy: Query Depth <= 6, Cost <= 500
Observed Headers: Introspection enabled; no depth limiter configured
Calibration Trace: Depth-9 nested query executed without cost rejection