Security Test: Pagination missing¶

Description¶

Default Severity: low

If your API returns too much data at once because there's no limit on the results, it can overwhelm both the client and server. Without pagination, a request could pull back a huge dataset, which might slow down or even crash the system. This makes it easier for attackers to trigger denial-of-service conditions or expose more data than needed, especially when data is sensitive. Developers often miss this because it's tempting to simplify queries without considering the impact of unbounded responses, so always remember to limit and paginate your API results.

Reference:

• https://graphql.org/learn/pagination/

Configuration¶

Identifier: resource_limitation/pagination_missing

Examples¶

All configuration available:

checks:
  resource_limitation/pagination_missing:
    skip: false # default
    options:
      threshold_high: 250 # default
      threshold_low: 20 # default
      threshold_medium: 100 # default

Increase the threshold

checks:
  resource_limitation/pagination_missing:
    skip: true
    threshold_low: 1000
    threshold_medium: 2000
    threshold_high: 5000

Options¶

Options can be set in the options key of the Security Test Configuration.

Compliance and Standards¶