missing-rate-limiting-anti-pattern

name	missing-rate-limiting-anti-pattern
description	Security anti-pattern for missing rate limiting (CWE-770). Use when generating or reviewing API endpoints, authentication systems, or public-facing services. Detects absence of request throttling enabling brute force, credential stuffing, and DoS attacks.

Missing Rate Limiting Anti-Pattern

Severity: High

Summary

Applications fail to restrict action frequency, allowing unlimited requests to endpoints. Enables brute-force attacks, data scraping, and denial-of-service through resource-intensive requests.

The Anti-Pattern

The anti-pattern is exposing endpoints (especially authentication/resource-intensive) without controlling request frequency per user or IP.

BAD Code Example

# VULNERABLE: The login endpoint has no rate limiting.
from flask import request, jsonify

@app.route("/api/login", methods=["POST"])
def login():
    username = request.form.get("username")
    password = request.form.get("password")

    # Endpoint callable thousands of times per minute from same IP.
    # Attacker uses password lists for brute-force/credential stuffing,
    # trying millions of passwords until finding correct one.
    if check_credentials(username, password):
        return jsonify({"status": "success", : generate_token(username)})
    :
         jsonify({: }), 



 ():
    query = request.args.get()
    
    
    results = perform_complex_search(query)
     jsonify(results)