You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: modules/ROOT/pages/security/securing-a-graphql-api.adoc
-37Lines changed: 0 additions & 37 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -330,34 +330,6 @@ While the xref:getting-started/graphql-aura.adoc[Getting started page for GraphQ
330
330
Both potentially expose information that can be used to gain insight on specifics of your GraphQL schema and execute targeted malicious operations.
331
331
Be sure to deactivate both in a customer-facing real-life scenario.
332
332
333
-
[[best-practice-internal-errors]]
334
-
=== Catch internal errors
335
-
336
-
For the same reason it is advisable to avoid introspection and data field suggestions, it can make your API more secure to catch internal errors and redact which information you want to pass on to the end user.
337
-
338
-
For example, the following error reveals information XY:
339
-
340
-
[source, json, indent=0]
341
-
----
342
-
"data": {
343
-
"field": "value"
344
-
}
345
-
----
346
-
347
-
You can use Apollo Server's link:https://www.apollographql.com/docs/apollo-server/data/errors[Error Handling] to catch such internal errors and then decide how to pass this on to your users:
348
-
349
-
[source, typescript, indent=0]
350
-
----
351
-
import { ApolloServerErrorCode } from '@apollo/server/errors';
352
-
353
-
if (error.extensions?.code === ApolloServerErrorCode.GRAPHQL_PARSE_FAILED) {
354
-
// respond to the syntax error
355
-
356
-
} else if (error.extensions?.code === "MY_CUSTOM_CODE") {
357
-
// do something else
358
-
359
-
}
360
-
----
361
333
362
334
363
335
=== Limit query depth
@@ -496,15 +468,6 @@ Here are a few examples.
496
468
// examples
497
469
498
470
499
-
=== Validate user input
500
-
501
-
User input may potentially be malicious, for example, it could contain code snippets which get executed when running queries against the database.
502
-
503
-
Follow the input validation methods summarized in the link:https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html#input-validation[OWASP Cheat Sheet Series].
0 commit comments