Security Test: Alias limit¶

Description¶

Default Severity: low

GraphQL's alias feature lets you use different names for the same sub-query, which sounds handy until attackers use it to sneak multiple similar queries in one go without tripping defensive measures like rate limiting. Essentially, if you're not careful, someone might flood your server with a lot of requests that all look like one legitimate query, letting them exhaust resources or hide harmful requests. This vulnerability stems from treating each alias as a separate entity and not counting them properly when limiting query requests. Developers often fall into the trap of assuming rate limits are foolproof without considering how aliasing might let malicious users bypass those controls, potentially leading to performance issues or denial of service if left unaddressed.

Reference:

• https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/12-API_Testing/01-Testing_GraphQL

Configuration¶

Identifier: resource_limitation/graphql_alias_limit

Examples¶

All configuration available:

checks:
  resource_limitation/graphql_alias_limit:
    skip: false # default
    options:
      threshold: 10 # default

Options¶

Options can be set in the options key of the Security Test Configuration.

Compliance and Standards¶