Skip to content

Commit aa4fbf9

Browse files
authored
Apply suggestions from code review
1 parent 4bd172a commit aa4fbf9

File tree

1 file changed

+0
-37
lines changed

1 file changed

+0
-37
lines changed

modules/ROOT/pages/security/securing-a-graphql-api.adoc

Lines changed: 0 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -330,34 +330,6 @@ While the xref:getting-started/graphql-aura.adoc[Getting started page for GraphQ
330330
Both potentially expose information that can be used to gain insight on specifics of your GraphQL schema and execute targeted malicious operations.
331331
Be sure to deactivate both in a customer-facing real-life scenario.
332332

333-
[[best-practice-internal-errors]]
334-
=== Catch internal errors
335-
336-
For the same reason it is advisable to avoid introspection and data field suggestions, it can make your API more secure to catch internal errors and redact which information you want to pass on to the end user.
337-
338-
For example, the following error reveals information XY:
339-
340-
[source, json, indent=0]
341-
----
342-
"data": {
343-
"field": "value"
344-
}
345-
----
346-
347-
You can use Apollo Server's link:https://www.apollographql.com/docs/apollo-server/data/errors[Error Handling] to catch such internal errors and then decide how to pass this on to your users:
348-
349-
[source, typescript, indent=0]
350-
----
351-
import { ApolloServerErrorCode } from '@apollo/server/errors';
352-
353-
if (error.extensions?.code === ApolloServerErrorCode.GRAPHQL_PARSE_FAILED) {
354-
// respond to the syntax error
355-
356-
} else if (error.extensions?.code === "MY_CUSTOM_CODE") {
357-
// do something else
358-
359-
}
360-
----
361333

362334

363335
=== Limit query depth
@@ -496,15 +468,6 @@ Here are a few examples.
496468
// examples
497469

498470

499-
=== Validate user input
500-
501-
User input may potentially be malicious, for example, it could contain code snippets which get executed when running queries against the database.
502-
503-
Follow the input validation methods summarized in the link:https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html#input-validation[OWASP Cheat Sheet Series].
504-
505-
// Examples?
506-
507-
508471

509472
== Further reading
510473

0 commit comments

Comments
 (0)