An API without limits will do whatever a client asks, as often as the client asks. Login, one-time codes, search, and “give me every row” are the routes that get expensive first. Waiting for real traffic to discover that is how you discover it in production.
OWASP’s API Security Top 10 for 2023 lists this as API4:2023 Unrestricted Resource Consumption. The published control includes a limit on how often a client can call the API, a limit on sensitive operations such as OTP and password recovery, and a cap on how many records one response returns. We are citing the 2023 edition. There is not a newer OWASP API list we are pretending exists.
Where the limits go first
| Route | Why it is first |
|---|---|
| Login, password reset, OTP | Cheap to call, costly when someone automates them |
| Search and filtered lists | One request can turn into a bad query |
| Webhook receivers | A retry storm and an attacker look similar |
| Exports | They read more data than a page view |
A single “1000 requests a minute” that treats a health check like a login is a number, not a design. Anonymous routes key by IP. Authenticated routes key by user. An office NAT is a reason to tune the login limit, not a reason to remove it.
API-first backends already say rate limiting belongs on the API. Security basics is passwords, roles, and backups — not this. The launch checklist names the control. This article is where we place it.
What the app should do
Laravel’s throttle middleware is enough for most of the systems we ship. Return a clear 429. Cap page size on list endpoints so a client cannot ask for a million rows because the parameter was trusted. API4 calls that out specifically.
Limits are not a substitute for authorization. A logged-in user who may not export the customer table should get a 403, not a slower 200.
Straight next step
Send the public and authenticated routes if you are about to expose an API beyond your own Nuxt app. We will mark the ones that need a tight limit before launch. We will not sell a separate security product for a middleware change.
