Escape - The API Security Blog

Nowadays, whenever you enter a web application, chances are that it uses some API (REST or GraphQL). Why? Simply because APIs are very beneficial and cost-effective, but despite the numerous advantages that APIs bring to the table, there is one disadvantage that to me as a cyber security engineer outweighs

This article is part of the series "Pentesting GraphQL 101". 1. Pentesting GraphQL 101 Part 1 - Discovery 2. Pentesting GraphQL 101 Part 2 - Interaction 3. Pentesting GraphQL 101 Part 3 - Exploitation Exploitation or finding vulnerabilities might not be the most crucial step in a typical

One GraphQL benefit over REST is that you can define a generic backend to serve applications. GraphQL defines its data schema, explicitly providing which object lives in the current application and operations to query these objects. Introduction Let's start with an example schema. type User { name: String! organization:

We are utterly excited to introduce GraphQL Armor compatibility with Yoga 2. When the GraphQL Ecosystem encounters Security A few weeks ago, we released GraphQL Armor, an open-source middleware to add a security layer on top of GraphQL endpoints and mitigate common attacks. GraphQL Armor blocks abusive requests by putting

Zip Bombs are a thing of the past, but the concept behind them is still relevant nowadays. Indeed, your GraphQL application might be vulnerable to what we'll call GraphQL Bombs in this article. Read on to know if you're vulnerable and how to secure your GraphQL

For several days now, your users have been complaining about losing access to your web service. If at first you thought it was a simple coincidence and certainly a fault of the users, the incident starts to be strongly repeated and noticed. You rush to your monitors and notice an

We released GraphQL Armor, a middleware for Apollo Server that adds a security layer to any GraphQL endpoint in minutes. ☠️ GraphQL less secure than REST, really? While being so much more convenient to use, GraphQL is known to introduce security vulnerabilities compared to most modern REST implementations. But GraphQL is

This post is a write-up of a talk I gave at the GraphQL San Francisco Conference. You can find the video on youtube. If you are in the bay area do not forget to also join the GraphQL SF group on meetup. It's commonly said that GraphQL is

Every team at Escape works in the same repository. We decided to follow the so-called monorepo workflow. This repository is our ground; its layers are our (concise) history.