How to fix Unrestricted Resource Consumption
in ASP.NET Core
Executive Summary
Unrestricted Resource Consumption in ASP.NET Core is a classic DoS vector where an attacker exhausts CPU, RAM, or disk space by abusing unbounded endpoints. Whether it is a multi-gigabyte file upload or an expensive LINQ query with no pagination, failing to set bounds is an invitation for a service outage. We fix this by enforcing strict request limits, implementing rate limiting, and honoring cancellation tokens.
The Vulnerable Pattern
[HttpPost("process-data")]
[DisableRequestSizeLimit]
public async Task ProcessData(IFormFile file)
{
// VULNERABILITY: No size limit, no rate limit, no timeout.
// An attacker can send a 50GB stream to exhaust disk/RAM.
using var reader = new StreamReader(file.OpenReadStream());
var content = await reader.ReadToEndAsync();
return Ok(content.Length);
} The Secure Implementation
The secure implementation applies a three-tier defense. First, [RequestSizeLimit] forces Kestrel to drop connections exceeding 1MB before the application layer even touches the bytes. Second, we inject a CancellationToken; if the attacker terminates the connection to 'hang' a thread, the server stops processing immediately. Finally, we integrate the native ASP.NET Core Rate Limiting middleware (FixedWindow) to prevent a single IP from flooding the endpoint with legitimate-sized requests that aggregate into a DoS.
[HttpPost("process-data")] [RequestSizeLimit(1048576)] // Limit to 1MB public async TaskProcessData(IFormFile file, CancellationToken ct) { // FIX 1: Enforce payload size limits at the attribute level. if (file == null || file.Length == 0) return BadRequest(); // FIX 2: Use CancellationToken to stop processing if the client disconnects. using var stream = file.OpenReadStream(); byte[] buffer = new byte[1024]; while (await stream.ReadAsync(buffer, 0, buffer.Length, ct) > 0) { // Process chunks safely... } return Ok("Processed safely.");}
// In Program.cs: // builder.Services.AddRateLimiter(options => { // options.AddFixedWindowLimiter(“strict”, opt => { // opt.PermitLimit = 10; // opt.Window = TimeSpan.FromSeconds(10); // }); // });
Your ASP.NET Core API
might be exposed to Unrestricted Resource Consumption
74% of ASP.NET Core apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.