Security Test: Field limit¶

Description¶

Default Severity: medium

The vulnerability happens when systems accept queries containing an excessive number of fields, which can overwhelm resources or accidentally reveal sensitive data. Attackers can intentionally create overly complex queries to stress the server, leading to performance issues or even a denial of service, while also potentially exposing more information than intended. Developers sometimes overlook imposing strict limits on query complexity, leaving systems at risk if attackers exploit these weaknesses.

Reference:

• https://www.apollographql.com/blog/graphql/security/securing-your-graphql-api-from-malicious-queries/

Configuration¶

Identifier: resource_limitation/graphql_field_limit

Examples¶

All configuration available:

checks:
  resource_limitation/graphql_field_limit:
    skip: false # default
    options:
      threshold: 100 # default

Options¶

Options can be set in the options key of the Security Test Configuration.

Compliance and Standards¶