Why Your GraphQL APIs Are Increasingly Under Attack
summary
Shows how attackers find and exploit GraphQL with concrete steps: single curl to find endpoint, fingerprint server and version from JSON responses, and run automated scanners that surface vulnerabilities. Analysis of CVEs and HackerOne reports finds 70% DOS reports in practice. Concrete defenses include persistent queries and signed hashes, an agnostic gateway layer that enforces field-weighted rate limits plus OpenTelemetry-driven dynamic cost scoring, query protections (fragment/directive limits), introspection separation, and operation registries — all presented as implemented mitigations.
AI-written summary · about
chapters (16)
- 0:00Introduction to GraphQL security
- 1:04Developer-driven GraphQL adoption
- 3:15Enterprise adoption challenges
- 5:42Security team awareness gap
- 7:07GraphQL attack surface analysis
- 8:52Bypassing classic API security
- 11:22Beyond introspection and depth limits
- 12:26Query protection and DOS attacks
- 13:52Rate limiting limitations
- 16:40Dynamic rate limiting strategies
- 18:27Introspection and persistent queries
- 20:12Schema subset for access control
- 22:02Observability and error handling
- 23:47Compliance and audit trails
- 24:28Real-time incident alerts
- 25:09Key questions for your team
related talks
32mMind your GraphQL APIs: how to reduce their attack surface
37mIs your GraphQL API safe? Let’s find out
15mNavigating GraphQL Vulnerabilities: SRE / DevSecOps
26mDon't Panic: A Developer's Guide to Building Secure GraphQL APIs.
39mDon't Panic: A Developer's Guide to Building Secure GraphQL APIs
29mDamn GraphQL - Defending and Attacking APIs
30mTechniques to Protect Your GraphQL API
20mAdvanced GraphQL Security with AI-Driven Threat Detection