Security Test: Depth limit¶

Scanner(s) Support¶

Description¶

Default Severity: medium

A GraphQL depth limit vulnerability happens when an attacker sends a very deeply nested query that forces your server to do much more work than it should. Because GraphQL doesn't automatically restrict how many levels deep a query can go, someone could intentionally create a query that drains server resources and slows or even crashes your service. This can open the door to denial-of-service attacks or make your application reveal more information than intended. Developers often overlook tightening these limits, leading to unintended resource allocation and potential security risks.

Reference:

• https://www.howtographql.com/advanced/4-security/

Configuration¶

Identifier: resource_limitation/graphql_depth_limit

Examples¶

All configuration available:

checks:
  resource_limitation/graphql_depth_limit:
    skip: false # default
    options:
      threshold: 3 # default

Options¶

Options can be set in the options key of the Security Test Configuration.

Compliance and Standards¶