How to fix Lack of Resources & Rate Limiting
in Salvo
Executive Summary
In the world of Rust web frameworks, Salvo is efficient, but efficiency doesn't stop DoS. Without explicit resource constraints, an attacker can hammer your endpoints, exhausting file descriptors or CPU cycles. Lack of rate limiting is a direct path to service unavailability. We fix this by injecting middleware that tracks request velocity per source identifier.
The Vulnerable Pattern
use salvo::prelude::*;#[handler] async fn heavy_op() -> &‘static str { // This endpoint is wide open to flooding “Data processed.” }
#[tokio::main] async fn main() { let router = Router::with_path(“api/resource”).get(heavy_op); let acceptor = TcpListener::new(“127.0.0.1:5800”).bind().await; Server::new(acceptor).serve(router).await; }
The Secure Implementation
The vulnerable code lacks any mechanism to throttle incoming traffic, making it trivial to overwhelm the server. The secure implementation utilizes Salvo's 'rate-limiter' crate. We use 'RemoteIpIssuer' to identify unique clients by their IP address and 'FixedGuard' to manage the window. By wrapping the router in the 'limiter' hoop, we enforce a strict quota (5 requests per 10 seconds), returning a 429 Too Many Requests status once exceeded, effectively preserving system resources.
use salvo::prelude::*; use salvo::rate_limiter::{RateLimiter, FixedGuard, RemoteIpIssuer, Quota}; use std::time::Duration;#[handler] async fn heavy_op() -> &‘static str { “Data processed with protection.” }
#[tokio::main] async fn main() { // Define a quota: 5 requests per 10 seconds let limiter = RateLimiter::new( FixedGuard::new(), RemoteIpIssuer, ).with_quota(Quota::with_period(Duration::from_secs(10)).unwrap().allow_burst(std::num::NonZeroU32::new(5).unwrap()));
let router = Router::new() .hoop(limiter) // Apply rate limiting middleware .path("api/resource") .get(heavy_op); let acceptor = TcpListener::new("127.0.0.1:5800").bind().await; Server::new(acceptor).serve(router).await;
}
Your Salvo API
might be exposed to Lack of Resources & Rate Limiting
74% of Salvo apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.