Skip to main content

Batch Limit

Description​

Some GraphQL engines support batching of multiple queries into a single request. This allows users to request multiple objects or multiple instances of objects efficiently. However, an attacker can leverage this feature to evade many security measures, including rate limiting.

Remediation​

Disable or limit queries batching in your GraphQL engine.

Apollo

Disable query batching in ApolloServer constructor options.

Install our open source package GraphQL Armor for Apollo.

Otherwise, you can switch off batching in the ApolloServer constructor options.

const server = new ApolloServer({
  ...
  allowBatchedHttpRequests: false,
)}

Source: https://www.apollographql.com/docs/apollo-server/requests/#batching

Graphqlyoga

Install our open source package GraphQL Armor for Yoga.

Configuration​

CheckId: complexity/batch_limit

Options​

  • threshold : Maximum number of batched documents allowed to be sent

Examples​

Ignoring this check​

{
    "checks": {
        "complexity/batch_limit": {
            "skip": true
        }
    }
}

Check with all default options​

{
    "checks": {
        "complexity/batch_limit": {
            "options": {
                "threshold": 15
            }
        }
    }
}

Score​

  • Escape Severity: LOW
  • OWASP: A08:2023
  • PCI DSS: 6.5.8
  • CWE
    • 20
    • 400
    • 664
    • 770
    • 799
  • WASC: 10

CVSS​

  • CVSS_VECTOR: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:H/RL:O/RC:R
  • CVSS_SCORE: 4.9

References​

https://lab.wallarm.com/graphql-batching-attack/