STIGQter: STIG Summary: Application Programming Interface (API) Security Requirements Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025: STIGQter: STIG Summary: Application Programming Interface (API) Security Requirements Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025:SV-274526r1143552_rule
V-274526
SRG-APP-000095
SRG-APP-000095-API-001755
CAT II
10
Build or configure the API Gateway to enforce rate limits and log these events, including the thresholds for triggering rate limiting.
If an API Gateway is not in use, this is Not Applicable.
1. Access the API Gateway's configuration to verify rate limiting is enabled. Rate limiting will specify how many requests are allowed per time period (e.g., 1000 requests per hour).
2. Verify rate-limiting events are configured to be logged. This includes events where a user exceeds their allowed request rate, triggering rate-limiting actions.
3. After triggering rate-limiting events, check the API's audit or access logs. Entries should:
- Indicate when a rate limit was exceeded.
- Include details about the API key or user who exceeded the limit.
- Provide the rate-limiting threshold (e.g., "rate limit exceeded: 1000 requests per hour").
- Mention the specific API endpoint that was accessed.
4. Test the API to verify it behaves correctly when a rate limit is exceeded. For example, the API should return an appropriate status code (e.g., HTTP 429 Too Many Requests).
5. Check the API Gateway logs to determine if the gateway logs rate-limiting events properly, including identifying when the threshold is exceeded and what actions are taken (e.g., temporary block).
6. Review the organization's security policies to ensure rate-limiting events are properly audited as per requirements.
If the API Gateway is not auditing rate limiting events, this is a finding.
V-274526
False
SRG-APP-000095-API-001755
If an API Gateway is not in use, this is Not Applicable.
1. Access the API Gateway's configuration to verify rate limiting is enabled. Rate limiting will specify how many requests are allowed per time period (e.g., 1000 requests per hour).
2. Verify rate-limiting events are configured to be logged. This includes events where a user exceeds their allowed request rate, triggering rate-limiting actions.
3. After triggering rate-limiting events, check the API's audit or access logs. Entries should:
- Indicate when a rate limit was exceeded.
- Include details about the API key or user who exceeded the limit.
- Provide the rate-limiting threshold (e.g., "rate limit exceeded: 1000 requests per hour").
- Mention the specific API endpoint that was accessed.
4. Test the API to verify it behaves correctly when a rate limit is exceeded. For example, the API should return an appropriate status code (e.g., HTTP 429 Too Many Requests).
5. Check the API Gateway logs to determine if the gateway logs rate-limiting events properly, including identifying when the threshold is exceeded and what actions are taken (e.g., temporary block).
6. Review the organization's security policies to ensure rate-limiting events are properly audited as per requirements.
If the API Gateway is not auditing rate limiting events, this is a finding.
M
5703