We at Escape have been scanning GraphQL APIs for vulnerabilities for more than two years. In this post, we will share the most common GraphQL vulnerabilities, affecting close to all GraphQL APIs we have scanned. We strongly recommend you to check your GraphQL APIs for these vulnerabilities.

The relational aspect of GraphQL can be a vulnerability exploited by running deep and cyclic queries causing your API to crawl under the load and crash. That's a Denial of Service. Learn how it works and how you can protect your API!

You receive a call in the middle of the night from the SRE team: All production data has been deleted from your company's various relational databases. Many of the company's internal services are therefore down. You absolutely need to fix the problem immediately and identify the problem. Once you log

Back at the office, you try to connect to one of your application's servers. But for some reason, your account is no longer granted access. Anyway. You have a backup so you can restore it to a previous state in a minute. Still, you have to figure out what happened

GraphQL offers an amazing developer experience. But the same features that help you in development, can disclose critical information to cyberattacks in production. Learn how you can fix this vulnerability.

HTTP is the text protocol that has been running the web, but its upgraded version HTTPS should always be preferred to avoid data leaks. Read more to understand the risk and how you can implement the security fix in your GraphQL framework of choice.

GraphQL aliasing is a powerful feature. But with great power comes great vulnerability: batch attacks and DoS. In this post, we explain how it works and how to remediate it in your GraphQL API.

CSRF (Cross-Site Request Forgery) is one of the top 3 most common vulnerabilities of web applications. It forces authenticated users to perform unwanted actions. In this post, we explain how it works and how to remediate it in your GraphQL API.

Confusion between authentication and authorization causes data leaks. Learn the difference and how to implement the right access control pattern in your GraphQL API.