What is GraphQL?
GraphQL is a standardized language for describing and making queries to APIs. Originally built by Facebook in 2015 for use in their mobile applications, GraphQL provides a number of benefits to application developers when compared to a traditional REST API:
- Client applications are able to request only the information they need, minimizing the amount of data sent.
- GraphQL allows for more complicated queries to represented, reducing the number of API requests that must be made.
- All input data is type-checked against a schema defined by the developer, assisting with data validation.
1. Inconsistent Authorization Checks
2. REST Proxies Allow Attacks on Underlying APIs
3. Missing Validation of Custom Scalars
4. Failure to Appropriately Rate-limit
5. Introspection Reveals Non-public Information
GraphQL, as a new standard for interacting with APIs, includes some protections against data validation issues commonly seen in REST APIs. However, as a more complex solution, the complex nature of GraphQL makes certain weaknesses more likely. With a sample API, we demonstrated some of our common findings when testing these APIs.