High ThreatWeb & Injection DefenseCWE-112
GraphQL Security: Query Depth Limiting & Introspection
Harden GraphQL APIs by enforcing query depth limiting, cost complexity analysis, and disabling introspection in production.
Vulnerability Overview
Nested GraphQL queries can exponentially consume server resources.
Attackers send deeply nested recursive queries to cause DoS.
Vulnerable Code
const server = new ApolloServer({ schema });Accepts queries of infinite depth.
Remediated Code
const server = new ApolloServer({ schema, validationRules: [depthLimit(5)] });Limits query depth.
Hardening Rules
- 1Limit query depth
- 2Calculate query complexity
- 3Disable introspection in prod
Frequently Asked Questions
Why disable introspection?
Introspection reveals your entire schema to attackers, aiding in payload crafting.