Introduction to GraphQL Security
GraphQL provides powerful query capabilities but introduces unique security challenges. Unlike REST APIs, GraphQL's flexibility can be exploited for denial of service, data exposure, and injection attacks.
GraphQL vs REST Security
Key Differences:
Single endpoint vs multiple
Client-defined queries
Introspection by default
Nested query complexity
Type system exposure
Common GraphQL Vulnerabilities
Risk Areas:
Introspection exposure
Query complexity attacks
Authorization bypass
Injection vulnerabilities
Batching attacks
Information disclosure
Introspection Security
The Introspection Risk
Problem:
Exposes entire schema
Reveals all types and fields
Shows sensitive field names
Aids attack reconnaissance
Mitigation Strategies
Options:
Disable in production
Restrict to authenticated users
Implement rate limiting
Monitor introspection usage
Configuration:
Apollo Server: introspection: false
GraphQL Yoga: Built-in controls
Custom middleware filtering
Query Complexity Attacks
Attack Types
Denial of Service:
Deeply nested queries
Wide queries (many fields)
Circular references
Alias overloading
Example Malicious Query:
query {
users {
friends {
friends {
friends {
friends {
name
}
}
}
}
}
}Mitigation Strategies
Query Cost Analysis:
Assign costs to fields
Calculate total query cost
Reject expensive queries
Set complexity limits
Depth Limiting:
Maximum nesting depth
Reject deep queries
Configure per operation
Rate Limiting:
Per-client limits
Per-query limits
Time-based throttling
Authorization
Field-Level Authorization
Requirements:
Check permissions per field
Implement in resolvers
Use directives
Validate at runtime
Implementation:
type User {
id: ID!
email: String! @auth(requires: ADMIN)
name: String!
salary: Float @auth(requires: HR)
}Query-Level Authorization
Controls:
Operation type restrictions
Mutation authentication
Subscription permissions
Role-based access
Object-Level Authorization
Requirements:
Filter results by permission
Validate ownership
Apply business rules
Consistent enforcement
Injection Vulnerabilities
SQL Injection
Risk:
Arguments passed to database
Dynamic query building
Unvalidated input
Prevention:
Parameterized queries
ORM usage
Input validation
Type enforcement
NoSQL Injection
Risk:
Operator injection
Query manipulation
Data extraction
Prevention:
Input sanitization
Query parameterization
Type validation
Input Validation
Type System Validation
Built-in Protection:
Type checking
Non-null enforcement
Enum validation
Scalar validation
Custom Validation
Additional Checks:
Input length limits
Format validation
Business rule validation
Sanitization
Implementation:
const validateInput = (input) => {
if (input.length > 1000) throw new Error("Input too long");
if (!/^[a-zA-Z0-9]+$/.test(input)) throw new Error("Invalid characters");
};Batching and Aliasing Attacks
Attack Description
Technique:
Multiple queries in one request
Alias-based duplication
Rate limit bypass
Resource exhaustion
Example:
query {
a1: user(id: "1") { password }
a2: user(id: "2") { password }
a3: user(id: "3") { password }
# ... thousands more
}Mitigation
Controls:
Alias limits
Query cost counting
Batching limits
Request timeouts
Security Best Practices
Schema Design
Recommendations:
Minimal exposure
Avoid sensitive field names
Implement cursor pagination
Use input types
Version carefully
Runtime Protection
Controls:
Query complexity limits
Depth limits
Timeout configuration
Error message sanitization
Logging and monitoring
Deployment Security
Requirements:
HTTPS only
Authentication required
Rate limiting
WAF protection
Monitoring
Monitoring and Detection
Key Metrics
Monitor:
Query complexity scores
Error rates
Resolver performance
Unusual query patterns
Failed authorization
Alerting
Alert On:
Complexity threshold exceeded
Introspection attempts
Authorization failures
Error rate spikes
Unusual traffic patterns
Tools and Libraries
Security Libraries
Options:
graphql-depth-limit
graphql-query-complexity
graphql-rate-limit
graphql-shield
Testing Tools
Options:
InQL (Burp extension)
GraphQL Cop
Clairvoyance
graphw00f
Implementation Checklist
Schema Security
Introspection disabled in production
Sensitive fields protected
Input types validated
Deprecation marked
Query Protection
Depth limits configured
Complexity limits set
Timeout configured
Alias limits applied
Authorization
Authentication required
Field-level authorization
Object-level filtering
Subscription security
Operations
Logging enabled
Monitoring configured
Alerting defined
Error handling sanitized
Conclusion
GraphQL security requires understanding its unique attack surface. By implementing complexity limits, proper authorization, input validation, and monitoring, organizations can safely leverage GraphQL's powerful query capabilities.