GraphQLShield: CWE-Aware Defense in Depth for GraphQL APIs in Go-
summary
An open-source Go middleware called GraphQLShield enforces three concrete defenses: static schema checks that flag cyclic types, missing depth limits and exposed sensitive fields before deploy; per-variable runtime sanitization via go-safeinput that catches SQLi, XSS, command injection, path traversal and NoSQL operator injection; and resolver code audits (gosec/cryptoguard-go style) that detect hardcoded secrets, weak crypto and missing auth checks. Demo on a gqlgen API shows it blocks 7 attack vectors while allowing legit requests and claims coverage of 14 CWE classes.
AI-written summary · about
chapters (8)
- 0:00Introduction and background
- 1:02GraphQL security challenges
- 3:54Threat model and CWE mapping
- 5:38Middleware security layers
- 8:35Integration and demo setup
- 9:16Live attack detection demo
- 11:07Open source contributions
- 12:10Closing and Q&A
related talks
20mAdvanced GraphQL Security with AI-Driven Threat Detection
15mNavigating GraphQL Vulnerabilities: SRE / DevSecOps
39mDon't Panic: A Developer's Guide to Building Secure GraphQL APIs
32mMind your GraphQL APIs: how to reduce their attack surface
27mWhy Your GraphQL APIs Are Increasingly Under Attack
29mTop 10 GraphQL Security Checks for Every Developer
30mTechniques to Protect Your GraphQL API
37mIs your GraphQL API safe? Let’s find out