Rule Definition
When throttling is not enabled there is a possibility of excessive client requests on the system resources which can lead to exhaustion and ultimately Denial of Service. At the same time it is to be kept in mind that a very small limit can hinder genuine requests. The concurrent requests, calls and sessions should be reviewed and changed based on context of usage.

Remediation
Always define enable throttling

Violation Code Sample

<serviceBehaviors>
 <behavior name="etravel.restfulservice.mailprocessingservice_behavior">
 <serviceDebug includeExceptionDetailInFaults="true" />
 <serviceMetadata httpGetEnabled="false" httpsGetEnabled="false"/>
 </behavior>
//Violation - Throttling not enabled

__________________________________

Service Behavior defined in Source Code:


ServiceHost host = new ServiceHost();  
host.Open();  
Console.Write("Service started...");  
Console.Read();

Fixed Code Sample

Throttling defined in Config File:

<serviceBehaviors>
 <behavior name="etravel.restfulservice.mailprocessingservice_behavior">
          <serviceThrottling 
            maxConcurrentCalls="1" 
            maxConcurrentSessions="1" 
            maxConcurrentInstances="1"
          />
 <serviceDebug includeExceptionDetailInFaults="true" />
 <serviceMetadata httpGetEnabled="false" httpsGetEnabled="false"/>
 </behavior>


_____________________________________________________

Throttling defined in Source Code:

ServiceHost host = new ServiceHost(typeof(ThrottlingInWCF.ThrottlingInWCF));  
  
ServiceThrottlingBehavior stb= new ServiceThrottlingBehavior();  
stb.MaxConcurrentCalls=2;  
stb.MaxConcurrentInstances=2;  
stb.MaxConcurrentSessions=2;  
  
host.Description.Behaviors.Add(stb);  
host.Open();  
Console.Write("Service started...");  
Console.Read();

https://cwe.mitre.org/data/definitions/770.html https://cwe.mitre.org/data/definitions/400.html https://docs.microsoft.com/en-us/dotnet/api/system.servicemodel.dispatcher.servicethrottle.maxconcurrentinstances?view=netframework-4.8