← Back to sandbox
Backend & API Intermediate 3 possible tests

Rate Limiting Bypass

Two endpoints — one has no rate limiting at all, one enforces a 10-requests-per-minute limit. Find which one never blocks, no matter how many times you hammer it.

What is this?

Rate limiting protects endpoints from brute-force attacks, denial-of-service, and credential stuffing. A login endpoint without rate limiting allows an attacker to try thousands of passwords per second. A missing 429 response is a security bug.

What is hidden here

BugLogin endpoint: 50+ attempts with no block — never returns 429
CorrectSearch endpoint: blocked after 10 requests per minute with 429

Endpoint Tester

POST /api/login/ — Login Endpoint (Buggy — no rate limit)
0
No attempts yet
GET /api/search/ — Search Endpoint (Correct — 10/min limit)
0
No attempts yet
Suggested Test Inputs ▼
  • Click Attempt Login 20+ times — are you ever blocked?
  • Click Search 10+ times — what happens after the 10th?
  • Use browser DevTools Network tab to see the raw status codes