Security Testing for GraphQL Backed Applications
summary
StackHawk runs automated dynamic tests against GraphQL endpoints, claiming active vulnerability discovery rather than just best‑practice checks. Configuration uses a YAML file that marks graphql enabled and points at a schema path or introspection endpoint, with options for operation selection and recursion depth. Scans run via docker run hawk scan, emit terminal results and a web link, show the exact request/response and a curl command to reproduce, and integrate with CI/CD, Slack and Jira so findings can break a PR build or be triaged. Use caution running against production.
AI-written summary · about
chapters (6)
- 0:00Intro
- 0:52Application Security Testing
- 2:37GraphQL Configuration
- 3:30Docker Scan
- 4:35Stackhawk App
- 5:55Outro
related talks
09mHow to Make GraphQL Security Easier with StackHawk
08mModern GraphQL API Security Testing
09mAutomated Application Security Testing
09mAutomated Application Security Testing with StackHawk
08mAutomated Security Testing for JS Apps & Underlying APIs
15mDev-first API and application security testing
09mAutomated Application Security Testing
09mAutomated Application Security Testing with StackHawk