Don't Panic: A Developer's Guide to Building Secure GraphQL APIs
summary
Covers real breaches (GitHub 2020 missing auth, WordPress plugin DoS, Instagram archive exposure) and demos a local vulnerable instance using Damn Vulnerable GraphQL API and Postman to show exploits and fixes. Recommends concrete mitigations: persisted queries to shrink attack surface, max depth checks and query cost analysis plus rate limits to stop expensive and batch attacks, GraphQL Shield–style permission rules, and strict validation for custom scalars. Cites State of GraphQL 2022 (≈3,000 devs; persisted queries ~20.5%, depth/rate use ~23–26%) and Gartner adoption forecast.
AI-written summary · about
chapters (35)
- 0:00Introduction
- 0:42About Me
- 2:07GraphQL Story
- 4:19NDC App
- 7:18GraphQL Gateway
- 8:26Why GraphQL Matters
- 10:57Dont Panic
- 11:34GitHub
- 11:59WordPress
- 12:13Instagram
- 12:45National Vulnerability Database
- 14:12Word Cloud
- 15:00Example
- 15:42The Collection
- 17:39Creating a New Request
- 18:02In introspection
- 20:13Field Suggestions
- 21:23Denial of Service
- 22:03Batch Query Attack
- 22:27Multiple Attempts
- 22:47Recursive Relationships
- 23:54Duplicate Fields
- 24:07Fragments
- 24:52Denialist
- 25:16SQL Injection
- 27:36Authorization
- 28:30Denial of service attacks
- 29:37Batch attack
- 30:56Persistent queries
- 32:40GraphQL introspection
- 33:26Custom Scalars
- 34:46State of GraphQL
- 36:41Arrested Development
- 37:17GraphQL Foundation
- 38:10Resources
related talks
26mDon't Panic: A Developer's Guide to Building Secure GraphQL APIs.
32mMind your GraphQL APIs: how to reduce their attack surface
30mTechniques to Protect Your GraphQL API
27mWhy Your GraphQL APIs Are Increasingly Under Attack
15mNavigating GraphQL Vulnerabilities: SRE / DevSecOps
29mDamn GraphQL - Defending and Attacking APIs
29mTop 10 GraphQL Security Checks for Every Developer
43mBe Cool and Hack GraphQL