GraphQL Security Best Practices and Hardening
summary
Covers concrete defenses: remove version headers and disable introspection to slow fingerprinting, use Cloudflare/WAFs but expect bypasses, and apply enable complexity analysis plus global timeouts and graph-aware rate limits to prevent cheap, small-request DoS (note recent HTTP/2 zero day affecting many clouds). Shows real exploits: IDOR via mutable numeric IDs and UUID leakage, NoSQL injection through custom scalars into MongoDB, and how batch aliases amplify attacks; recommends auditable authorization and schema-wide protections.
AI-written summary · about
chapters (8)
- 0:00Introduction to GraphQL security
- 1:39Understanding the attack surface
- 3:27Reconnaissance and mitigation
- 9:20Unique GraphQL security challenges
- 11:58Denial of service protection
- 17:04Authorization and data leakage
- 23:33Injection and input validation
- 26:08Conclusion and key takeaways
related talks
23mGraphQL Security Vulnerabilities in the Wild
59mPractical Security for Web Applications
34mWeb security explored through horror movies
01h 00mDefense-in-depth engineering
19mFrontend Security is a Thing
56mHow to avoid vulnerabilities and adopt security best practices?
52mPractical Security in Web Applications
48mSecurity Practices for Developers