Rate Limiting
429 is a feature — throttle auth and expensive routes. Lab :8818.
Visual · api_rate_limit
Rate limits protect availability and brute force. Original Cyberlium.
Unlimited login attempts are a gift.
Rate limiting bounds how often a client may call sensitive endpoints. Test 429 behavior on YOUR lab — do not flood stranger APIs.
1. Where to throttle
Login, password reset, OTP, expensive search, GraphQL.
Per-IP and per-account dimensions both matter.
Command guide
Try these commands — Where to throttle
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Rate limiting — https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html OWASP API4 — https://owasp.org/API-Security/editions/2023/en/0xa4-unrestricted-resource-consumption/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Rate-limit literacy against YOUR lab only
Command — copy this
for i in $(seq 1 5); do curl -sS -o /dev/null -w "req $i HTTP %{http_code}
" http://127.0.0.1:8818/login -X POST -H "Content-Type: application/json" -d '{"user":"lab","pass":"x"}'; sleep 0.3; donePrimary tools to practice this lesson: curl, bash. Reference sites: Rate limiting (https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html); OWASP API4 (https://owasp.org/API-Security/editions/2023/en/0xa4-unrestricted-resource-consumption/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Lab evidence
Loop requests until 429. Record headers like Retry-After if present.
No DoS against third parties.
3. Bypasses to know
Distributed sources, header spoofing — defenders watch carefully.
Still: do not practice bypasses on systems you do not own.
4. What you ship: rate limit literacy
Throttle sensitive routes. Lab 429 transcript.
5. What you record before the next lesson
Status sequence ending in 429 on :8818.
6. Wrong vs right: stranger APIs vs literacy on systems you own
Worked failure — same API word, opposite target. Right never needs a live shop or classmate token.
- Wrong: Flood a public login for a YouTube video.
- Right: Lab 429 only. Next: injection shapes.
Mission: provoke 429 on lab
1) Loop lab /login. 2) Catch 429. 3) Write where else to throttle.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “What is Retry-After?”
APPLY: 429 means:
APPLY: True or False: Flood stranger logins for practice.
APPLY: Throttle especially:
Injection Shapes in APIs
Part of API Security with AI — Rate Limit Injection and SSRF Shapes.
SSRF Shapes
Part of API Security with AI — Rate Limit Injection and SSRF Shapes.
Defense Lab — 429 and Policy Sheet
Part of API Security with AI — Rate Limit Injection and SSRF Shapes.