Vercel project has rate limiting rules configured
Vercel projects are assessed for rate limiting rule configuration. Rate limiting protects applications from abuse, brute-force attacks, and DDoS attempts by restricting the number of requests from a single source within a given time window.
ProwlerRisk
Without rate limiting, the application is vulnerable to brute-force attacks on authentication endpoints, API abuse, resource exhaustion, and denial-of-service attacks. Attackers can overwhelm the application with excessive requests, degrading performance for legitimate users or exploiting endpoints without throttling.
Run this check with Prowler
Run in Prowler Cloudprowler vercel --checks security_rate_limiting_configuredRecommendation
Configure rate limiting rules to protect critical endpoints such as authentication, API routes, and form submissions. Start with conservative thresholds and adjust based on traffic patterns to avoid blocking legitimate users.
Remediation
Other
Check Code
from typing import List
from prowler.lib.check.models import Check, CheckReportVercel
from prowler.providers.vercel.lib.billing import plan_reason_suffix
from prowler.providers.vercel.services.security.security_client import security_client
class security_rate_limiting_configured(Check):
"""Check if rate limiting rules are configured for each project.
This class verifies whether each Vercel project has at least one rate
limiting rule configured to protect against abuse and DDoS attacks.
"""
def execute(self) -> List[CheckReportVercel]:
"""Execute the Vercel Rate Limiting Configuration check.
Iterates over all firewall configurations and checks if at least
one rate limiting rule is present.
Returns:
List[CheckReportVercel]: A list of reports for each project.
"""
findings = []
for config in security_client.firewall_configs.values():
report = CheckReportVercel(metadata=self.metadata(), resource=config)
if not config.firewall_config_accessible:
report.status = "MANUAL"
report.status_extended = (
f"Project {config.project_name} ({config.project_id}) "
f"could not be assessed for rate limiting rules because the "
f"firewall configuration endpoint was not accessible. "
f"Manual verification is required."
f"{plan_reason_suffix(config.billing_plan, {'hobby'}, 'rate limiting rules are not available on the Vercel Hobby plan.')}"
)
elif config.rate_limiting_rules:
report.status = "PASS"
report.status_extended = (
f"Project {config.project_name} ({config.project_id}) "
f"has {len(config.rate_limiting_rules)} rate limiting rule(s) configured."
)
else:
report.status = "FAIL"
report.status_extended = (
f"Project {config.project_name} ({config.project_id}) "
f"does not have any rate limiting rules configured."
)
findings.append(report)
return findings