Intermediate LevelWeb Security & Cyber Defense
What unique security risks exist in GraphQL (Query Depth, Query Complexity, Introspection)?
❓ Interview Prompt: Explain GraphQL security risks, deeply nested queries, Query Depth Limiting, Query Complexity Analysis, and disabling introspection in production.
GraphQL's flexibility creates unique Denial of Service (DoS) attack vectors:
3 GraphQL Attack Vectors:
1
Deeply Nested Queries (Query Depth Attack): 'author { books { author { books { author ... } } } }'. A 100-level query crashes database CPU!
2
Query Complexity: Requesting expensive fields simultaneously.
3
Schema Introspection: Allows attackers to discover all schema queries and types.
•
Defenses: Enforce Query Depth limits ('graphql-depth-limit'), compute query complexity costs, and disable schema introspection in production builds.
Code Implementation Example
typescript
import depthLimit from 'graphql-depth-limit';
import { createApolloServer } from 'apollo-server-express';
const server = createApolloServer({
schema,
validationRules: [depthLimit(5)], // ✅ Enforce maximum query depth limit of 5!
introspection: process.env.NODE_ENV !== 'production' // Disable introspection in production
});💡Enforcing maximum GraphQL query depth limits with graphql-depth-limit.
🎯 Interview Key Takeaway
Limit GraphQL query depth and complexity, and disable schema introspection in production to prevent DoS attacks.
#GraphQL Security#Query Depth#DoS#Intermediate
Back to all Web Security & Cyber Defense Questions→