Salt Continues to Lead API Security With Innovation to Protect GraphQL APIs

GraphQL security misconceptions‍

A common misconception is that GraphQL APIs are more secure when compared to REST. The reality is that GraphQL is susceptible to many of the same vulnerabilities as REST and comes with its own list of unique pitfalls. Developers like GraphQL for its efficiencies, but these efficiencies can also create unique opportunities for attackers. Some of the common security pitfalls of GraphQL include:

• Introspection - If not turned off or restricted in production, attackers get visibility into the schema, supported queries, and the entire layout of databases. If documentation is available, attackers also have access to detailed descriptions of every query supported, including the hidden ones.
• Verbose errors - Like introspection, errors must be properly configured and restricted in production to keep attackers from using details returned in error messages to understand the schema and build valid queries.
• Access controls - Each layer of the graph requires a distinct set of access controls, creating complexity and potential for errors. If access controls are missing or not properly implemented, attackers can exploit these gaps and target many of the threats defined in the OWASP API Security Top 10.
•  Injection - GraphQL is simply a layer between the client and databases. Without proper controls, attackers can still target REST proxies and other infrastructure with SQLi, NoSQL injection, OS Command, SSRF, and CRLF attacks.
• Rate limiting - Batched queries are efficient for developers but are a risk without properly configured limits. An attacker can batch multiple queries with 2FA tokens in a single request to target authentication mechanisms while bypassing all traditional rate-limiting controls.‍
• Denial of Service - Nested queries are another efficiency for developers that require properly configured limits. An attacker can bypass traditional security controls and cause a denial-of-service (DoS) with a single request containing an excessive number of nested queries.
  

Another misconception is that current API security tools and controls can secure GraphQL APIs. In reality, without native support to understand the complexities of GraphQL, traditional security controls provide limited protection at best and leave teams with a false sense of security.

GraphQL has a unique structure and capabilities, and this results in unique challenges when it comes to security. Awareness of the unique pitfalls and vulnerabilities is needed to help teams properly secure GraphQL deployments, and education is needed to help developers apply best practices when building GraphQL APIs. 

DevOps teams can’t do it alone. They need to move fast and release new code, and vulnerabilities will slip through to production, with many only found at runtime. Tools with native GraphQL support are needed to complement DevOps security efforts, protect APIs at runtime, create a feedback loop for continuous hardening, and support rapid innovation.‍

Protecting GraphQL APIs with Salt‍

With native support for GraphQL, we understand the unique capabilities, pitfalls, and challenges required for security. Our patented platform with big data, AI and ML understands the complex structure of each GraphQL query to gain the context required to secure GraphQL APIs. 

All the capabilities that you expect from Salt to protect your REST APIs are now extended to GraphQL giving you a single platform to protect all of your APIs. With Salt you can now:

• Discover all GraphQL APIs automatically and continuously including shadow (unknown) and zombie (outdated) APIs to maintain a single view of your entire API landscape and eliminate blind spots.
• Uncover GraphQL APIs expose sensitive data such as PII and understand when exposure changes to maintain a complete view of risk and meet compliance requirements.
• Prevent attacks targeting GraphQL APIs by leveraging Salt big data, AI, and ML to establish a baseline for each GraphQL API and gain the context needed to pinpoint and stop attackers early in their reconnaissance.

• Eliminate GraphQL vulnerabilities with insights from across the API lifecycle to help teams continuously improve security and ship more secure APIs.

At Salt we never stop taking on new challenges and never stop innovating, laser focused on our mission to make all APIs attack proof. To learn more about Salt and how we can stop attacks targeting GraphQL and secure all your APIs, reach out to schedule a personalized demo.

‍