Rate Limiting feature to be included in TM1 web as lack of Rate Limiting feature is considered as vulnerability.

As suggested by client bank audit team rate limit would be upto 3 to 5 attempts after that user must be locked with proper notification that limit is exceeded.

Please find the brief details of Description, Impact and Recommendation of the Vulnerability below:

Vulnerability Description: Lack of Rate Limiting

Impact: Attackers can use this for Denial of Service (DoS).

Recommendation: Implement a limit on how often a client can call the API within a defined timeframe. Notify the client when the limit is exceeded by providing the limit number and the time at which the limit will be reset. Add proper server-side validation for query string and request body parameters, specifically the one that controls the number of records to be returned in the response. Define and enforce maximum size of data on all incoming parameters and payloads such as maximum length for strings and maximum number of elements in arrays.

The mentioned vulnerability need to be fixed for compliance as indicated by Banking client at the earliest.

Needed By

Month

Post comment

By clicking the "Post Comment" or "Submit Idea" button, you are agreeing to the IBM Ideas Portal Terms of Use.
Do not place IBM confidential, company confidential, or personal information into any field.

Please enter your email address

RELATED IDEAS

Rate Limiting feature to be included in TM1 web as lack of Rate Limiting feature is considered as vulnerability.