search

OWASP / API-Security

OWASP API Security Project
https://owasp.org/www-project-api-security/
Other
2.07k stars 377 forks source link

2023 RC API 4: Unrestricted Resource Consumption - How to Prevent, Suggested Reword #71

Closed MrPRogers closed 1 year ago

MrPRogers commented 1 year ago

The first bullet of How to Prevent is "Use container-based solutions that make it easy to limit memory, CPU, ...". Containers is only one way of achieving limits, you could also use serverless technology such as Lambdas (even virtualisation / managed services on cloud allows us to limit these aspects too).

Therefore would recommend slight wording order shift to "Use a solution that makes it easy to limit memory, CPU ..., such as Containers / Serverless code)." This way the guidance has a wider coverage and not bound to a particular implementation approach / technology.

PauloASilva commented 1 year ago

Hi @MrPRogers, Thanks for your feedback.

I understand your point and agree with the suggested change. To be honest I like the "lambdas" recommendation better than the more generic "serverless code" one.

Would you like to open a Pull Request? Maybe we can continue the discussion based on something more concrete. Please refer this issue in the PR.

Cheers, Paulo A. Silva

MrPRogers commented 1 year ago

Pull Request #91 - created. I have kept wording as Serverless Code but put in E.g. Lambda, reason being is that Lambda is tied to AWS Cloud and so rule is still applicable for Azure Functions and Google's Cloud Functions too.

MrPRogers commented 1 year ago

As rewording approved and merged into master branch, closed to aid project maintenance.