How to fix Lack of Resources & Rate Limiting
in ServiceStack
Executive Summary
ServiceStack's performance-first architecture is a double-edged sword. Out of the box, it lacks aggressive resource governing, making it trivial for an adversary to trigger DoS via expensive DTO processing or thread pool exhaustion. To secure the stack, we must implement global and per-route throttling using the RateLimitFeature and custom Request Filters.
The Vulnerable Pattern
public class ExportService : Service
{
// VULNERABLE: No rate limiting or resource constraints.
// An attacker can spam this endpoint to trigger heavy DB reads and memory allocation.
public object Any(LargeDataExport request)
{
var data = Db.Select(x => x.Type == request.Type);
return data;
}
} The Secure Implementation
The fix involves a multi-layered defense. First, we register the 'RateLimitFeature' plugin, which intercepts requests at the pre-transaction stage. By mapping rules to specific routes or using the [RateLimit] attribute, we prevent single clients from monopolizing the thread pool. We also implement a Global Request Filter to drop oversized payloads early (413 Payload Too Large) before they hit the serializer. For production environments, ensure 'ICacheClient' is backed by Redis to maintain rate-limit counters across multiple web nodes, preventing bypasses via load balancer rotation.
public override void Configure(Container container) { // SECURE: Register RateLimitFeature with Redis for distributed state Plugins.Add(new RateLimitFeature { Rules = { new RateLimitRule { Route = "/export*", Limit = 2, Period = TimeSpan.FromMinutes(1), Message = "Rate limit exceeded. Slow down, hacker." } } });// Global Request Filter to enforce max execution time and payload size this.GlobalRequestFilters.Add((req, res, dto) => { if (req.ContentLength > 1024 * 1024) // 1MB Limit throw new HttpError(413, "Payload Too Large"); });}
[RateLimit(5, 60)] // Per-DTO attribute enforcement public class ExportService : Service { public object Any(LargeDataExport request) { return Db.Select(x => x.Type == request.Type); } }
Your ServiceStack API
might be exposed to Lack of Resources & Rate Limiting
74% of ServiceStack apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.