API Security: Securing GraphQL without going around in circles
summary
A demo GraphQL site so.net shows a browser-heavy app using an Apollo server and Apollo Studio sandbox that proxies to a REST backend (port 2000 left exposed). The talk demonstrates an unsigned JWT kept in localStorage that gets forged to access other accounts, GraphQL introspection enabled revealing admin mutations, an SSRF/path‑traversal against backend endpoints, and unrestricted resource consumption via deep/wide queries. Scanning data cites 4,400 secrets found across 160 public GraphQL APIs; fixes include GraphQL Shield, Armor and careful resolver hardening.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 5:27GraphQL architecture and benefits explained
- 13:31Top 10 API risks 2023
- 26:48Server-side request forgery
- 30:05API sprawl challenges
- 33:18Resource consumption risks
- 40:56GraphQL security flaws
- 43:28Hardening GraphQL servers
- 47:22Q&A
related talks
23mGraphQL Security Vulnerabilities in the Wild
37mIs your GraphQL API safe? Let’s find out
15mNavigating GraphQL Vulnerabilities: SRE / DevSecOps
26mDon't Panic: A Developer's Guide to Building Secure GraphQL APIs.
39mDon't Panic: A Developer's Guide to Building Secure GraphQL APIs
24mUnderstanding GraphQL Security: Protecting Your Server from Abuse
27mDesigning Secure GraphQL APIs : Not a Paradigm Shift but Handling Complexity
20mAdvanced GraphQL Security with AI-Driven Threat Detection