/rest/default/V1/guest-carts/ open to DDOS

[nikonratm]

But the IP is not the server, the request comes from the users browser and clearly the attackers have figured out how to easily spoof the referrer etc.

It's insane to me this is so easily exploited without an official patch / workaround. As usual seems like Magento OS customers are just left to whither on the vine...

[sashimitala02f]

I ran into the same issue and noticed a huge spike in resource usage. Turns out someone was hammering the guest cart endpoint over and over, likely using a tool like an IP Booter. I fixed it by adding a rate limit on that specific endpoint in my web server config and also put in a WAF rule to catch similar patterns early. Made a big difference in keeping things stable.