Building secure GraphQL APIs at the NDC Oslo 2023 conference

Last month, I was honored to speak at the prestigious NDC Oslo 2023 conference. This premier developer conference attracts experts and innovators from around the globe each year, offering a platform for sharing knowledge and insights on software development practices. With more than 160 speakers, eight parallel speaker tracks, and a staggering 2,600 attendees, the conference proved to be an exceptional gathering of industry professionals.

Related: Download the Postman GraphQL Client

During the three-day schedule of speaker sessions, I had the opportunity to deliver a talk that aimed to equip developers with a comprehensive guide to building secure GraphQL APIs. Titled “Don’t Panic: A Developer’s Guide to Building Secure GraphQL APIs,” my session focused on empowering developers to adopt best security practices and ensure the robustness of their APIs. As a developer relations engineer for GraphQL at Postman, I am deeply passionate about enabling developers to create secure and reliable APIs.

This blog post will dive into the key takeaways from my talk at NDC Oslo 2023 and provide you with practical insights to enhance the security of your GraphQL APIs.

7 essential practices for securing GraphQL APIs

As GraphQL gains popularity for being a powerful data-fetching API, it becomes crucial to address its unique security challenges. By understanding the potential vulnerabilities and implementing effective security measures, you can protect your GraphQL APIs and the sensitive data they handle. Let’s take a closer look at the key takeaways from the talk, highlighting the essential practices and considerations for securing GraphQL APIs.

1. Implement middleware for authentication and authorization: Middleware can be a powerful tool for handling authentication and authorization in GraphQL APIs. By utilizing middleware functions, you can intercept and process requests before they reach the resolver functions, enabling you to enforce authentication and authorization checks at a centralized point. This approach ensures consistent security measures across your API. GraphQL Shield, which is based on GraphQL Middleware, provides a rule-based middleware layer that validates access rights, making it a valuable tool for implementing authentication and authorization.
2. Depth checks: Apply depth checks to limit the maximum depth of nested queries in your GraphQL API. This helps prevent potential performance issues caused by overly complex or deeply nested queries. You can mitigate the risk of resource-intensive or maliciously crafted queries by setting a reasonable depth limit.
3. Query cost analysis: Implement query cost analysis to limit the complexity and execution time of GraphQL queries. By assigning a cost to each field or operation in your schema and defining a maximum allowed query cost, you can prevent expensive queries from overwhelming your server and protect against denial-of-service (DoS) attacks.
4. Persisted queries: Consider implementing persisted queries, where clients send a query identifier instead of the full query text. This approach provides several benefits, such as reducing bandwidth usage, caching opportunities, and mitigating the risk of exposing sensitive information through query strings.
5. Disable introspection on production: Disable the introspection feature of GraphQL in production environments. While introspection can be useful for debugging and development purposes, it also exposes detailed information about your API’s schema, which could aid attackers in finding potential vulnerabilities. Disabling introspection helps reduce the attack surface and protects sensitive information.
6. Disable error suggestions on production: Prevent detailed error messages and suggestions from being returned in production environments. While error messages are valuable during development, they can potentially reveal sensitive information to attackers. Disabling error suggestions provide less information for potential attackers to exploit.
7. Validate and sanitize input through custom scalars: You can increase the risk of malicious or malformed input with custom scalar types. Enforce strict validation rules and sanitize user input to avoid a potential vulnerability.

These key takeaways provide strategies and best practices for enhancing the security of your GraphQL API, focusing on important measures to protect against common risks and attacks.

Watch the full presentation

More resources

If you’re interested in learning more about securing GraphQL APIs, here are some additional resources to explore:

• Clone the Damn Vulnerable GraphQL Application repository, an intentionally vulnerable implementation of Facebook’s GraphQL technology to learn and practice GraphQL security.
• Browse through the GraphQL Security Postman Public Workspace, including collections built to support your learning from the Damn Vulnerable GraphQL Application(DVGA).
• Read The Why’s of GraphQL Security to understand the importance and need for securing your GraphQL APIs.