Allocation of Resources Without Limits or Throttling

- app.use(express.json());
- app.use(express.urlencoded({ extended: true }));
+ app.use(express.json({ limit: '100kb' }));
+ app.use(express.urlencoded({ extended: true, limit: '100kb' }));
  

  import { PrismaClient } from '@prisma/client';
  const prisma = new PrismaClient();
  
  app.get('/api/users/:id', async (req, res) => {
    const user = await prisma.user.findUnique({
      where: { id: req.params.id },
      include: {
-       posts: true,         // Could be thousands of posts
-       comments: true,      // Could be tens of thousands
+       posts: {
+         take: 20,
+         orderBy: { createdAt: 'desc' },
+         select: { id: true, title: true, createdAt: true },
+       },
+       comments: {
+         take: 50,
+         orderBy: { createdAt: 'desc' },
+       },
      }
    });
    res.json(user);
  });
  

  from flask import Flask, request, jsonify
- 
- @app.route('/api/login', methods=['POST'])
+ from flask_limiter import Limiter
+ from flask_limiter.util import get_remote_address
+ 
+ limiter = Limiter(app=app, key_func=get_remote_address)
+ 
+ @app.route('/api/login', methods=['POST'])
+ @limiter.limit("5 per minute")
  def login():
      user = authenticate(request.json)
      return jsonify({'token': generate_token(user)})