Security Test: Security timeout¶

Description¶

Default Severity: info

When an application doesn’t set suitable limits on how long a request can run, attackers can purposely send heavy or complex requests that take too long to process, tying up resources and potentially denying service to legitimate users. This issue usually happens when developers rely on arbitrary timeout thresholds that don’t necessarily match the real-world demands of the application, leading to a situation where even a single carefully crafted query can slow down or temporarily incapacitate the service. Being unaware of proper timeout settings or defaulting to ones that are too generous is a common pitfall, and it leaves the system open to abuse and performance degradation.

Reference:

• https://medium.com/workflowgen/graphql-query-timeout-and-complexity-management-fab4d7315d8d

Configuration¶

Identifier: resource_limitation/timeout

Examples¶

All configuration available:

checks:
  resource_limitation/timeout:
    skip: false # default
    options:
      threshold_info: 4 # default
      threshold_low: 6 # default
      threshold_medium: 10 # default

Options¶

Options can be set in the options key of the Security Test Configuration.

Compliance and Standards¶