Achraf Ait Sidi Hammou

Achraf Ait Sidi Hammou is an experienced full-stack developer and deep-learning researcher. He is an expert in GraphQL Security and loves to write about GraphQL-related topics.

Achraf Ait Sidi Hammou

Achraf Ait Sidi Hammou — Last Publications

GraphQL XSS: Cross-Site Scripting Explained
GraphQL Vulnerability

GraphQL XSS: Cross-Site Scripting Explained

Every Monday morning, you go through your ritual and check the users' feedback. This week, despite all the wonderful feedback, some users are complaining that someone has impersonated them and performed actions on their accounts without their knowledge. After some investigation, you discover that all the complaining users have
Achraf Ait Sidi Hammou
Achraf Ait Sidi Hammou
5 min read
Using Rate Limiting to protect your GraphQL API against Brute Force Attacks

Using Rate Limiting to protect your GraphQL API against Brute Force Attacks

For several days now, your users have been complaining about losing access to your web service. If at first you thought it was a simple coincidence and certainly a fault of the users, the incident starts to be strongly repeated and noticed. You rush to your monitors and notice an
Achraf Ait Sidi Hammou
Achraf Ait Sidi Hammou
5 min read
GraphQL Cyclic Queries and Depth Limiting
GraphQL Vulnerability

GraphQL Cyclic Queries and Depth Limiting

The relational aspect of GraphQL can be a vulnerability exploited by running deep and cyclic queries causing your API to crawl under the load and crash. That's a Denial of Service. Learn how it works and how you can protect your API!
Achraf Ait Sidi Hammou
Achraf Ait Sidi Hammou
6 min read
SQL Injection in GraphQL
GraphQL Vulnerability

SQL Injection in GraphQL

You receive a call in the middle of the night from the SRE team: All production data has been deleted from your company's various relational databases. Many of the company's internal services are therefore down. You absolutely need to fix the problem immediately and identify the
Achraf Ait Sidi Hammou
Achraf Ait Sidi Hammou
5 min read
File Inclusion and Directory Traversal in GraphQL
GraphQL Vulnerability

File Inclusion and Directory Traversal in GraphQL

Back at the office, you try to connect to one of your application's servers. But for some reason, your account is no longer granted access. Anyway. You have a backup so you can restore it to a previous state in a minute. Still, you have to figure out
Achraf Ait Sidi Hammou
Achraf Ait Sidi Hammou
5 min read
When GraphQL field suggestions become a Security Issue
GraphQL Vulnerability

When GraphQL field suggestions become a Security Issue

GraphQL offers an amazing developer experience. But the same features that help you in development, can disclose critical information to cyberattacks in production. Learn how you can fix this vulnerability.
Achraf Ait Sidi Hammou
Achraf Ait Sidi Hammou
6 min read
How to prevent data leaks with HTTPS
GraphQL Vulnerability

How to prevent data leaks with HTTPS

HTTP is the text protocol that has been running the web, but its upgraded version HTTPS should always be preferred to avoid data leaks. Read more to understand the risk and how you can implement the security fix in your GraphQL framework of choice.
Achraf Ait Sidi Hammou
Achraf Ait Sidi Hammou
5 min read
Avoid GraphQL Denial of Service attacks through batching and aliasing
GraphQL Vulnerability

Avoid GraphQL Denial of Service attacks through batching and aliasing

GraphQL aliasing is a powerful feature. But with great power comes great vulnerability: batch attacks and DoS. In this post, we explain how it works and how to remediate it in your GraphQL API.
Achraf Ait Sidi Hammou
Achraf Ait Sidi Hammou
3 min read
Understanding and Dealing with Cross-Site Request Forgery Attacks (CSRF) in GraphQL
GraphQL Vulnerability

Understanding and Dealing with Cross-Site Request Forgery Attacks (CSRF) in GraphQL

CSRF (Cross-Site Request Forgery) is one of the top 3 most common vulnerabilities of web applications. It forces authenticated users to perform unwanted actions. In this post, we explain how it works and how to remediate it in your GraphQL API.
Achraf Ait Sidi Hammou
Achraf Ait Sidi Hammou
5 min read
Access Control Best Practices for GraphQL with Authentication and Authorization
GraphQL Vulnerability

Access Control Best Practices for GraphQL with Authentication and Authorization

Confusion between authentication and authorization causes data leaks. Learn the difference and how to implement the right access control pattern in your GraphQL API.
Achraf Ait Sidi Hammou
Achraf Ait Sidi Hammou
6 min read
Hacking GraphQL Playground
AppSec

Hacking GraphQL Playground

GraphQL Playground has had a known XSS security issue since 2020. We give 2 very concrete scenarios to show you how it could unfold if it were to be exploited in your organization.
Achraf Ait Sidi Hammou
Achraf Ait Sidi Hammou
4 min read
Graphinder: lightweight and blazing fast GraphQL endpoint finder
Pentesting

Graphinder: lightweight and blazing fast GraphQL endpoint finder

Introducing Graphinder, a lightweight and blazing fast GraphQL endpoint finder, making penetration testing on GraphQL much faster ⚡️
Achraf Ait Sidi Hammou
Achraf Ait Sidi Hammou
2 min read
Learn GraphQL in 8 simple steps
Tutorial

Learn GraphQL in 8 simple steps

The adoption of GraphQL is growing like crazy. But the learning curve is steep and getting started can be overwhelming. Here's our 8-step roadmap to ship production-ready APIs
Achraf Ait Sidi Hammou
Achraf Ait Sidi Hammou
6 min read
GraphQL Error Handling Best Practices for Security
Best Practices

GraphQL Error Handling Best Practices for Security

Error messages in GraphQL are rarely seen as a security concern, yet they should. The risk? Leaking information and data! Learn more about GraphQL errors and how to handle them.
Achraf Ait Sidi Hammou
Achraf Ait Sidi Hammou
5 min read
Building a type-safe Fullstack Application with GraphQL codegen
Tutorial

Building a type-safe Fullstack Application with GraphQL codegen

There are two approaches to defining your schema in GraphQL: schema-first and code-first. When using Typescript, you might find yourself having to write types again and again. Enters GraphQL codegen: your schema file becomes the single source of truth.
Achraf Ait Sidi Hammou
Achraf Ait Sidi Hammou
6 min read
GraphQL Security: 9 Best Practices You Need to Know
AppSec

GraphQL Security: 9 Best Practices You Need to Know

GraphQL has no security by default. All doors are open for the most basic attacks. Read more to learn about the exact threats and some simple strategies you can implement to get your users' data under lock and key 🔐
Achraf Ait Sidi Hammou
Achraf Ait Sidi Hammou
8 min read
How to Test your GraphQL Endpoints
Tutorial

How to Test your GraphQL Endpoints

Testing your GraphQL API is critical to ensure that your software's business logic is running as expected. Tests will reveal bugs and vulnerabilities before they make it to production. In this tutorial, we go through the practical steps to write unit and integration tests for your GraphQL API.
Achraf Ait Sidi Hammou
Achraf Ait Sidi Hammou
6 min read

Escape Blog Squad