Security field notes

Understand the bug. See the exploit. Ship the fix.

Practical guides to real-world web vulnerabilities, written by the team building the scanner that finds them.

Find a vulnerability guide

50 deep-dives · 16 topics

Follow via RSS

Posts tagged #api

3 posts

All topics Clear tag filter

Files, objects & APIs { user(id: 1043) { email } }

GraphQL5 min read

Broken Object-Level Authorization in GraphQL Resolvers

Authenticating a GraphQL caller is not the same as authorizing them for a specific object. When resolvers trust their id arguments, one logged-in user can read and mutate another user's data. Here is how BOLA reaches through resolver arguments, and how to enforce checks at every object.

Files, objects & APIs {user{posts{author{posts{id}}}}}

GraphQL4 min read

GraphQL Denial of Service: Deeply Nested and Aliased Queries

GraphQL lets the client decide how much work the server does. Without depth limits, cost analysis and batching caps, a single small request can amplify into enormous server load. Here is how nesting, aliasing and batching turn one query into a denial of service, and how to bound it.

Files, objects & APIs Did you mean "user"?

GraphQL4 min read

GraphQL Introspection: Mapping a Hidden Schema in One Query

Introspection is built into every GraphQL server, and by default it hands any client a complete map of your type system. Here is how a single query dumps every query, mutation and hidden field, how field suggestions leak the schema even when introspection is off, and how to lock it down.