Don't Panic: A Developer's Guide to Building Secure GraphQL APIs.
summary
Analysis of real incidents (GitLab, WordPress, Instagram) shows GraphQL vulnerabilities rising since 2019; missing auth checks and field-level leaks cause data exposure. The exploration uses the NVD API and a Postman collection built against the damn vulnerable GraphQL app to reproduce attacks: a 3‑call resource attack stalls a demo service for 51 seconds. Mitigations shown are moving auth into server context, using an allow‑list or Hasura approved queries, depth checks, disabling batching, GraphQL Shield middleware, and complexity/rate limits like Shopify/GitHub.
AI-written summary · about
chapters (12)
- 0:00Secure GraphQL APIs intro
- 1:52About the speaker
- 2:58Real-world security incidents
- 4:45GraphQL security landscape
- 7:18Authentication flaws
- 10:31Authorization violations
- 11:55Denial of Service attacks
- 13:40Batch attacks and rate limits
- 16:30Query whitelisting
- 17:35Introspection risks
- 19:20Resources and tools
- 20:48Summary
related talks
39mDon't Panic: A Developer's Guide to Building Secure GraphQL APIs
32mMind your GraphQL APIs: how to reduce their attack surface
23mGraphQL Security Vulnerabilities in the Wild
27mWhy Your GraphQL APIs Are Increasingly Under Attack
29mDamn GraphQL - Defending and Attacking APIs
15mNavigating GraphQL Vulnerabilities: SRE / DevSecOps
30mTechniques to Protect Your GraphQL API
37mIs your GraphQL API safe? Let’s find out