Is your GraphQL API safe? Let’s find out
summary
Scan of 3 GraphQL servers (Apollo Server, Graphene, GraphQL Java) finds that introspection enabled by default and error messages let attackers fingerprint implementations; analysis of 60 public APIs shows ~33% have high and 72% have medium issues. Practical probes use graphwoof and clairvoyance to fingerprint and enumerate schemas, and INQL to detect cycles; aliases let the same resolver run repeatedly so aliases allow repeated resolvers and enable wide/batch-style attacks. Remediations tested: disable introspection, enforce max query depth and max query complexity, assign custom complexity to heavy fields, add end‑to‑end tests and observability (Apollo Studio / GraphQL Hive).
AI-written summary · about
chapters (11)
- 0:00Introduction to GraphQL security
- 1:04Understanding GraphQL core
- 5:47Fingerprinting GraphQL servers
- 9:38Schema discovery vulnerabilities
- 13:42Hardening against discovery
- 18:41Mitigating denial of service
- 23:25Advanced query management
- 27:15Securing directives
- 30:19Observability and monitoring
- 32:41Summary of defense strategies
- 34:09General security and resources
related talks
32mMind your GraphQL APIs: how to reduce their attack surface
27mWhy Your GraphQL APIs Are Increasingly Under Attack
15mNavigating GraphQL Vulnerabilities: SRE / DevSecOps
24mUnderstanding GraphQL Security: Protecting Your Server from Abuse
26mDon't Panic: A Developer's Guide to Building Secure GraphQL APIs.
23mGraphQL Security Vulnerabilities in the Wild
51mAPI Security: Securing GraphQL without going around in circles
32mDecoding GraphQL: How to Map Hidden...