API Design · Senior · Question 18 of 75

How should a public API protect itself from abusive or expensive usage patterns?

1Only CORS
✓Correct answer: Layered limits: per-key rate limits, quotas, payload and page size caps, cost-based limits for expensive operations, and bot detection
3Only HTTPS

Explanation

OWASP API4 and API6 (unrestricted access to sensitive business flows) cover both resource and business abuse.

Further reading

Test yourself

Take the API Design · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.