Cybersecurity glossary
What is Pagination Abuse?
Learn what pagination abuse is, how attackers manipulate page size and cursors to scrape data or exhaust backends, and which limits offsets and monitoring stop API pagination abuse.
Definition
Pagination abuse is the misuse of list API pagination controls—such as oversized page sizes, deep offsets, cursor manipulation, or parallel page fetching—to scrape bulk data, bypass intended result windows, or inflict disproportionate backend load.
Why pagination abuse matters
List endpoints are how products scale UX—and how attackers scale extraction. Pagination abuse turns limit, offset, page, and cursor parameters into scraping engines or resource bombs.
If page size is unbounded or deep offsets are free, one client can outpace the cost assumptions behind your API.
Common abuse techniques
Oversized page size
Request limit=100000 to pull bulk data in fewer calls.
Deep offset scans
Walk enormous offsets to force expensive database skips.
Parallel page workers
Fan out many page fetches across IPs or tokens.
Cursor/filter tampering
Manipulate cursors or sort keys to revisit or skip controls.
How pagination abuse plays out
Map list endpoints
Find collection APIs and their pagination parameters.
Probe maximum page size
Increase limit until the API errors or silently caps.
Estimate total inventory
Use totals, cursors, or probing to learn collection size.
Automate extraction
Script page iteration to harvest objects and IDs.
Amplify cost
Combine deep offsets, nested expands, and parallel workers.
Monetize or disrupt
Resell scraped data or keep load high as a DoS tactic.
Safer pagination controls
| Control | Purpose |
|---|---|
| Hard max page size | Bound rows/bytes returned per call |
| Prefer cursor pagination | Avoid deep offset database penalties |
| Max pagination depth | Stop unbounded walking of huge collections |
| Cost-based rate limits | Meter rows/bytes, not only requests |
| Stable sort + authz filters | Prevent peeking across unauthorized slices |
| Expand/include limits | Block heavy nested payloads per page |
Pagination abuse prevention checklist
- Enforce a strict maximum page size server-side—never trust client limits.
- Prefer cursor-based pagination for large collections.
- Rate-limit by returned volume and identity, not request count alone.
- Apply object-level authorization inside each page query.
- Disable expensive total-count queries for huge datasets when possible.
- Detect sequential scraping patterns and anomalous parallelism.
- Cap GraphQL connection first/last arguments.
- Minimize fields on list endpoints to reduce scrape value.
The practical takeaway
Pagination abuse exploits a legitimate UX feature to scrape data or burn resources. Caps, cursors, and cost-aware rate limits keep list APIs usable without becoming bulk export tools for attackers.
Related security terms
Unrestricted Resource Consumption
OWASP category that includes unbounded pagination costs.
API Abuse
Broader misuse of legitimate API features including scraping.
Rate Limiting
Volume controls that should account for page size cost.
Excessive Data Exposure
Bulk scraping impact worsens when each page overshares fields.
Broken Object-Level Authorization (BOLA)
Pagination can amplify object ID harvesting for BOLA.
Frequently asked questions
What is pagination abuse in simple terms?
Attackers twist “next page” features to pull huge amounts of data or force the server to do expensive queries—like asking for a million rows per page or jumping to absurd offsets.
Why is offset pagination risky?
Large offsets can make databases scan and skip huge numbers of rows, creating CPU and I/O spikes even when the returned page is small.
Are cursors immune?
Cursors help performance but can still be abused with large page sizes, parallel consumers, or predictable cursor manipulation.
How does this relate to scraping?
Scrapers automate page iteration to extract catalogs, users, or pricing at scale.
What limits should APIs enforce?
Maximum page size, maximum depth/offset, stable sorting, and rate limits that weigh bytes or rows returned.
Can GraphQL connections be abused similarly?
Yes—oversized first/last arguments and nested connection fan-out are common.
Does authentication stop pagination abuse?
Authenticated scrapers are common. Authorization and quotas must still constrain bulk access.
References
Explore authoritative guidance and frameworks related to pagination abuse.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.