[ICACF-24] [Security][Pen Testing]Add request rate limiting to the API endpoints

[filis-cadar]

Jira Issue: https://jsw.ibm.com/browse/ICACF-24
Type: 10100
Priority: 3
Reporter: Filis Omer

[MohanLaksh]

X-Force Red was able to send multiple requests in rapid succession, revealing potential vulnerabilities in the system's rate-limiting and request-handling mechanisms.
This issue could be exploited by attackers in brute-force fuzzing and guessing attacks to discover expected application parameter values. In some cases, lack of rate-limiting may result in attackers consuming the available computing resuources, causing price surges in cloud accounts or creating a denial-of-service (DoS) condition that prevents legitimate usage.
The API endpoints accepted a high volume of messages in rapid succession without restriction.
Recommendations
• API Rate Limiting: Enforce a strict limit on the number of requests a client can make within a defined timeframe. This prevents excessive requests from overloading the system.
• User Notification: When a client exceeds the request limit, notify the client by providing the maximum allowed requests and the time when the limit will reset. This helps users understand and manage their authentication attempts while minimizing frustration from unexpected lockouts.
• Progressive Delays and Lockout Mechanism: Introduce progressively longer delays after multiple consecutive requests or temporarily lock the account following excessive attempts. Notify the user when these actions occur, alerting them to potential suspicious activity on their account.