Security Test: Pagination missing¶

Scanner(s) Support¶

Description¶

Default Severity: low

If your API returns too much data at once because there's no limit on the results, it can overwhelm both the client and server. Without pagination, a request could pull back a huge dataset, which might slow down or even crash the system. This makes it easier for attackers to trigger denial-of-service conditions or expose more data than needed, especially when data is sensitive. Developers often miss this because it's tempting to simplify queries without considering the impact of unbounded responses, so always remember to limit and paginate your API results.

Reference:

• https://graphql.org/learn/pagination/

Configuration¶

Identifier: resource_limitation/pagination_missing

Examples¶

All configuration available:

checks:
  resource_limitation/pagination_missing:
    skip: false # default
    options:
      element_number_threshold: 250 # default
      response_size_in_kb_threshold: 50 # default
      response_time_in_ms_threshold: 500 # default

Increase the threshold

checks:
  resource_limitation/pagination_missing:
    skip: true
    options:
      element_number_threshold: 1000
      response_size_in_kb_threshold: 200
      response_time_in_ms_threshold: 5000

Options¶

Options can be set in the options key of the Security Test Configuration.

Compliance and Standards¶