Navigating GraphQL Vulnerabilities: SRE / DevSecOps
summary
Escape scans 1,500+ production GraphQL endpoints using a feedback-driven API exploration engine and 500+ compute hours, finding 46,000+ security issues with ~10% rated critical and ~5,000 exposed PII/keys. Tests show GraphQL-specific failures: aliasing/batching bypasses HTTP rate limits to brute force accounts, recursive fragments create DoS by exhausting resolvers, and schema leak via Clairvoyance lets attackers reconstruct hidden admin mutations and change passwords. The team ships mitigations like the one-line middleware GraphQL Armor and an API Security Academy for hands-on remediation.
AI-written summary · about
chapters (8)
- 0:00Introduction to GraphQL security
- 1:49What is GraphQL and its risks
- 3:58Methodology for testing GraphQL APIs
- 6:05Classic API vulnerabilities in GraphQL
- 7:10GraphQL-specific vulnerabilities
- 11:06Sensitive data exposure in GraphQL
- 12:11Impact on SRE and DevSecOps
- 13:55Open-source security tools
related talks
23mGraphQL Security Vulnerabilities in the Wild
38mEscape Workshop: Discovering GraphQL Vulnerabilities in the Wild
32mMind your GraphQL APIs: how to reduce their attack surface
37mIs your GraphQL API safe? Let’s find out
27mWhy Your GraphQL APIs Are Increasingly Under Attack
32mDecoding GraphQL: How to Map Hidden...
26mDon't Panic: A Developer's Guide to Building Secure GraphQL APIs.
20mAdvanced GraphQL Security with AI-Driven Threat Detection