Security Test: Batch Limit¶

Description¶

Default Severity: low

The Batch Limit vulnerability happens when a GraphQL engine lets users send many queries in one go, and attackers can exploit this to slip past safeguards like rate limits. Instead of one request per query, a malicious user can bundle many queries together, overwhelming the system, bypassing security checks, or even causing a denial-of-service scenario. Developers need to be cautious about how many queries are allowed in one request and ensure their safeguards still work even when multiple queries are combined, as the default setup can be turned into an open door for abuse.

Reference:

• https://lab.wallarm.com/graphql-batching-attack/

Configuration¶

Identifier: resource_limitation/graphql_batch_limit

Examples¶

All configuration available:

checks:
  resource_limitation/graphql_batch_limit:
    skip: false # default
    options:
      threshold: 15 # default

Options¶

Options can be set in the options key of the Security Test Configuration.

Compliance and Standards¶