graphql-dotnet / graphql-dotnet/server

Limit number of queries in batch request

Open
#1,135 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
604
Forks
166
PR merge metrics
No merged PRs in 30d

Description

See `Batching Attacks` section: https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/12-API_Testing/01-Testing_GraphQL
> GraphQL supports batching of multiple queries into a single request. This allows users to request multiple objects or multiple instances of objects efficiently. However, an attacker can utilize this functionality in order to perform a batching attack.
...
Batching attacks can be used to bypass many security measures enforced on sites. It can also be used to enumerate objects and attempt to brute force multi-factor authentication or other sensitive information.

Currently, you can only enable or disable request batching, but you cannot limit the number of requests in the batch.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.