Achraf Ait Sidi Hammou

GraphQL Vulnerability

GraphQL XSS: Cross-Site Scripting Explained

Every Monday morning, you go through your ritual and check the users' feedback. This week, despite all the wonderful feedback, some users are complaining that someone has impersonated them and performed actions on their accounts without their knowledge. After some investigation, you discover that all the complaining users have each logged in from different IP addresses in the past week and moreover, one IP address comes up several times on different accounts. So there really could be an attacke

Achraf Ait Sidi Hammou

May 18, 2023 5 min read

Using Rate Limiting to protect your GraphQL API against Brute Force Attacks

For several days now, your users have been complaining about losing access to your web service. If at first you thought it was a simple coincidence and certainly a fault of the users, the incident starts to be strongly repeated and noticed. You rush to your monitors and notice an abnormal rate of requests for a number of days. If you had any doubts before, it is now clear: you are undergoing a brute force attack. Fortunately, this article is here to help you avoid this. What is a Bruteforce a

Achraf Ait Sidi Hammou

August 10, 2022 5 min read

GraphQL Vulnerability

GraphQL Cyclic Queries and Depth Limiting

The relational aspect of GraphQL can be a vulnerability exploited by running deep and cyclic queries causing your API to crawl under the load and crash. That's a Denial of Service. Learn how it works and how you can protect your API!

Achraf Ait Sidi Hammou

June 21, 2022 6 min read

GraphQL Vulnerability

SQL Injection in GraphQL

You receive a call in the middle of the night from the SRE team: All production data has been deleted from your company's various relational databases. Many of the company's internal services are therefore down. You absolutely need to fix the problem immediately and identify the problem. Once you log into the company's system you find that much of the information in your databases has been lost. Fortunately, you have a daily data backup so you can quickly restore the database to its previous

Achraf Ait Sidi Hammou

June 16, 2022 5 min read

GraphQL Vulnerability

File Inclusion and Directory Traversal in GraphQL

Back at the office, you try to connect to one of your application's servers. But for some reason, your account is no longer granted access. Anyway. You have a backup so you can restore it to a previous state in a minute. Still, you have to figure out what happened so it doesn't happen again. From the activity logs, it looks like you changed your user's password on this machine yourself but from an unusual address. Of course, you did not... That means someone had access to your credentials fo

Achraf Ait Sidi Hammou

June 15, 2022 5 min read

GraphQL Vulnerability

When GraphQL field suggestions become a Security Issue

GraphQL offers an amazing developer experience. But the same features that help you in development, can disclose critical information to cyberattacks in production. Learn how you can fix this vulnerability.

Achraf Ait Sidi Hammou

June 9, 2022 6 min read

GraphQL Vulnerability

How to prevent data leaks with HTTPS

HTTP is the text protocol that has been running the web, but its upgraded version HTTPS should always be preferred to avoid data leaks. Read more to understand the risk and how you can implement the security fix in your GraphQL framework of choice.

Achraf Ait Sidi Hammou

June 7, 2022 5 min read

GraphQL Vulnerability

Avoid GraphQL Denial of Service attacks through batching and aliasing

GraphQL aliasing is a powerful feature. But with great power comes great vulnerability: batch attacks and DoS. In this post, we explain how it works and how to remediate it in your GraphQL API.

Achraf Ait Sidi Hammou

June 2, 2022 3 min read

GraphQL Vulnerability

Understanding and Dealing with Cross-Site Request Forgery Attacks (CSRF) in GraphQL

CSRF (Cross-Site Request Forgery) is one of the top 3 most common vulnerabilities of web applications. It forces authenticated users to perform unwanted actions. In this post, we explain how it works and how to remediate it in your GraphQL API.

Achraf Ait Sidi Hammou

May 31, 2022 5 min read

GraphQL Vulnerability

Access Control Best Practices for GraphQL with Authentication and Authorization

Confusion between authentication and authorization causes data leaks. Learn the difference and how to implement the right access control pattern in your GraphQL API.

Achraf Ait Sidi Hammou

May 27, 2022 6 min read

AppSec

Hacking GraphQL Playground

GraphQL Playground has had a known XSS security issue since 2020. We give 2 very concrete scenarios to show you how it could unfold if it were to be exploited in your organization.

Achraf Ait Sidi Hammou

May 25, 2022 4 min read

Pentesting

Graphinder: lightweight and blazing fast GraphQL endpoint finder

Introducing Graphinder, a lightweight and blazing fast GraphQL endpoint finder, making penetration testing on GraphQL much faster ⚡️

Achraf Ait Sidi Hammou

May 12, 2022 2 min read

Tutorial

Learn GraphQL in 8 simple steps

The adoption of GraphQL is growing like crazy. But the learning curve is steep and getting started can be overwhelming. Here's our 8-step roadmap to ship production-ready APIs

Achraf Ait Sidi Hammou

April 27, 2022 6 min read

Best Practices

GraphQL Error Handling Best Practices for Security

Error messages in GraphQL are rarely seen as a security concern, yet they should. The risk? Leaking information and data! Learn more about GraphQL errors and how to handle them.

Achraf Ait Sidi Hammou

April 7, 2022 5 min read

Tutorial

Building a type-safe Fullstack Application with GraphQL codegen

There are two approaches to defining your schema in GraphQL: schema-first and code-first. When using Typescript, you might find yourself having to write types again and again. Enters GraphQL codegen: your schema file becomes the single source of truth.

Achraf Ait Sidi Hammou

March 31, 2022 6 min read

AppSec

GraphQL Security: 9 Best Practices You Need to Know

GraphQL has no security by default. All doors are open for the most basic attacks. Read more to learn about the exact threats and some simple strategies you can implement to get your users' data under lock and key 🔐

Achraf Ait Sidi Hammou

March 11, 2022 8 min read

Tutorial

How to Test your GraphQL Endpoints

Testing your GraphQL API is critical to ensure that your software's business logic is running as expected. Tests will reveal bugs and vulnerabilities before they make it to production. In this tutorial, we go through the practical steps to write unit and integration tests for your GraphQL API.

Achraf Ait Sidi Hammou

February 17, 2022 6 min read

Search