Agent WranglersLimits and business logic
Limit how fast and how much anyone can ask for. Check every price, step and count on the server, so each change happens exactly once.
- Required 5
Required
Limit how often anyone can call your APIs
APS-49Put a rate limit on every endpoint that does work for each request, such as APIs, agent endpoints, forms and report collectors.
Take the client address only from proxies you run
APS-50Read the client address from
X-Forwarded-FororForwardedonly when the request came through your own proxy. Take the entry that proxy added, and key every rate limit, ban and log on that one value.Keep regular expressions from stalling the server
APS-51Match untrusted input only with a linear-time regular expression engine, or cap the input length before a backtracking engine reads it. Never build a pattern from user input.
Work out every amount on the server
APS-52Never trust a price, quantity, discount or step order sent by the browser. The server works out every amount and checks that each step happened.
Make each change happen exactly once
APS-53Changes to money, stock and single-use items must happen once, even when the same request arrives twice at the same moment.
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/limits-and-business-logic">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.