io7m | single-page | multi-page | epub | Stonesignal User Manual 1.0.0-beta0001
8.1. Overview
Previous
8. Security
Up
Front Matter
Next

# 8.2. General

- 8.2.1. Potential Attack: API Resource Exhaustion
  - 8.2.1.1. Description
  - 8.2.1.2. Mitigation

## 8.2.1. Potential Attack: API Resource Exhaustion

## 8.2.1.1. Description

1
An attacker with access to the APIs could send specially crafted messages designed to exhaust server resources during parsing/validation of the messages.

## 8.2.1.2. Mitigation

1
All APIs exposed by the stonesignal server are defined in terms of simple, flat record types. The jackson parser is used to deserialize JSON and CBOR requests, and the dixmont package is used to prevent the deserialization of anything other than a fixed list of types.
2
Additionally, requests made to the device API and the data API have a hardcoded maximum size limit of 32768 octets.
8.1. Overview
Previous
8. Security
Up
Front Matter
Next
io7m | single-page | multi-page | epub | Stonesignal User Manual 1.0.0-beta0001