GraphQL security
You examine a GraphQL schema and its resolvers, recognise flaws from missing authorisation, batching and deep queries, and harden the API with query limits and persisted queries.
Level 301 · 16 lessons · 14 practice labs
Lessons
Getting to know GraphQL
- GraphQL basics: schema, queries, mutations and subscriptions
- Introspection: should the schema be public
- Inspecting GraphQL requests with Burp and GraphQL clients
- Short task: extract the lab GraphQL schema and mark sensitive fields
Flaws
- Missing authorisation at the resolver level
- Getting past attempt limits with batching and aliases
- Denial of service with deep and cyclic queries
- Injection in GraphQL arguments
- CSRF in GraphQL: GET and form content types
- Schema leakage in error messages and suggestions
- Short task: evidence four GraphQL flaws
Defence
- Depth, complexity and cost limits
- Persisted queries and allow-lists
- Moving authorisation into the business logic layer
- Logging GraphQL operations meaningfully
- Capstone: harden a GraphQL API and retest it
Practice labs
- Extract the schema through introspection: Extract the lab GraphQL API's schema through introspection and mark the fields that carry personal data.
- Turn off introspection in production: Show introspection is on in production, turn it off and keep it on in the development environment.
- Schema leaks through suggestion messages: Show error suggestions leak field names while introspection is off and turn suggestions off.
- An attack surface map from the schema: Classify the queries and mutations in the schema by authorisation need and test and fix the unprotected ones.
- A missing authorisation check in a resolver: Prove another user's email is reachable through a nested user field and add an authorisation check to the resolver.
- An attempt limit beaten with aliases: Prove dozens of login attempts fit in one request through aliases and apply the limit per operation.
- A mutation that runs over GET: CSRF in GraphQL: Show mutations are accepted over GET and form content types and allow JSON POST only.
- A service exhausted by a deep query: Measure in the lab the response time of a deep query built on circular relations and add a depth limit.
- Injection in an argument: Prove the search argument mixes into the database query and switch to a parameterised query in the resolver.
- Log GraphQL operations meaningfully: Fix logging so that operation name, type and user are recorded in a log where every request hits one path.
- Define a cost limit: Assign cost points to fields, set a per-query maximum and show an expensive query is refused.
- An allow list with persisted queries: Register the queries the client uses as persisted queries and prove queries not on the list are refused.
- Move authorisation into the business layer: Move checks scattered across resolvers into the business layer and test that access to the same data by other paths is protected too.
- Harden a GraphQL API: Tarnova Reports: Close the introspection, authorisation and cost issues in the fictional Tarnova Reports API and retest.
About this course
You examine a GraphQL schema and its resolvers, recognise flaws from missing authorisation, batching and deep queries, and harden the API with query limits and persisted queries.
What you will learn
- Getting to know GraphQL
- Flaws
- Defence
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.