Top 10 GraphQL Security Checks for Every Developer
summary
Cites concrete CVEs CVE-2021-41248 CVE-2023-38503 CVE-2023-34047 and a real credential stuffing incident at 23andMe as motivations then lists ten checks including Disable introspection in production, Limit query depth 5, use Persisted queries / allowlist to stop arbitrary payloads, enforce robust auth and authorization checks including object level checks and mass assignment prevention, run query complexity scoring (example threshold ~1000), validate inputs and mask errors, and automate all checks in code and CI/CD.
AI-written summary · about
chapters (4)
- 0:00Introduction and agenda
- 1:12Why GraphQL security matters
- 2:56Top 10 GraphQL security checks
- 22:33Summary and conclusion
related talks
32mMind your GraphQL APIs: how to reduce their attack surface
26mDon't Panic: A Developer's Guide to Building Secure GraphQL APIs.
39mDon't Panic: A Developer's Guide to Building Secure GraphQL APIs
23mGraphQL Security Vulnerabilities in the Wild
15mNavigating GraphQL Vulnerabilities: SRE / DevSecOps
24mUnderstanding GraphQL Security: Protecting Your Server from Abuse
27mWhy Your GraphQL APIs Are Increasingly Under Attack
37mIs your GraphQL API safe? Let’s find out