Panel - Things to Consider When Auditing Your GraphQL Infrastructure for Security
summary
Panel summarizes hands-on lessons from auditing the Apollo Router: a 20 person-day review finds six issues (two DoS, three medium, a CSRF vector) and prompts a CSRF prevention feature enabled by default. Testing relies on manual, logic-driven testing not automated scanners, prefers code access, uses the nql Burp plugin to enumerate schemas, and recommends engaging external auditors months before beta (typical pentest cadence yearly; 6–8 week consultant lead time).
AI-written summary · about
chapters (13)
- 0:00Introduction and panel setup
- 1:02Panelists' security backgrounds
- 2:27Common security issues in audits
- 4:56Timing for security audits
- 7:26Compliance and pentesting cycles
- 8:28Scoping GraphQL security audits
- 11:17Collaboration needs for audits
- 12:40Limitations of security tools
- 16:34Different audit approaches
- 21:31Post-audit recommendations
- 23:19Staying current on threats
- 25:02Apollo router security audit case study
- 31:10Closing remarks and Q&A
related talks
15mNavigating GraphQL Vulnerabilities: SRE / DevSecOps
37mIs your GraphQL API safe? Let’s find out
51mAPI Security: Securing GraphQL without going around in circles
23mGraphQL Security Vulnerabilities in the Wild
26mDon't Panic: A Developer's Guide to Building Secure GraphQL APIs.
32mMind your GraphQL APIs: how to reduce their attack surface
27mWhy Your GraphQL APIs Are Increasingly Under Attack
39mDon't Panic: A Developer's Guide to Building Secure GraphQL APIs