Mind your GraphQL APIs: how to reduce their attack surface
summary
Research shows GraphQL risk concentrates in authorization failures and denial‑of‑service via complex queries. Public data lists ~45 CVE entries and ~75 HackerOne reports, with authorization problems dominating. Practical attack patterns include aliases and arrays allow batching to amplify cost, circular fragments, field duplication and directive storms. Defenses use depth/complexity limits, stateful rate quotas, GraphQL‑aware WAFs and external policy services. Try the Damn Vulnerable GraphQL Application and the Blackhat GraphQL book to reproduce and test these vulnerabilities.
AI-written summary · about
chapters (16)
- 0:00Start
- 0:21The Attack Surface of Graphql Apis
- 0:42Agenda
- 5:08Authorization
- 7:04Annotating a Schema with Custom Directed Custom Schema Directives
- 14:09Rules around Authorization
- 16:19Authorization Testing from a Security Context
- 17:04Denial of Service
- 20:39Using Aliases
- 23:25Circular Aquarius
- 24:23Stickable Fragments
- 25:24Field Duplication
- 26:09Directives
- 27:08Rules of Thumb around the Amount of Service
- 30:16Security Resources
- 30:59A Graphql Security Book
related talks
27mWhy Your GraphQL APIs Are Increasingly Under Attack
23mGraphQL Security Vulnerabilities in the Wild
37mIs your GraphQL API safe? Let’s find out
15mNavigating GraphQL Vulnerabilities: SRE / DevSecOps
26mDon't Panic: A Developer's Guide to Building Secure GraphQL APIs.
39mDon't Panic: A Developer's Guide to Building Secure GraphQL APIs
30mTechniques to Protect Your GraphQL API
24mUnderstanding GraphQL Security: Protecting Your Server from Abuse