Skip to main content

Batch Limit

Description

Some GraphQL engines support batching of multiple queries into a single request. This allows users to request multiple objects or multiple instances of objects efficiently. However, an attacker can leverage this feature to evade many security measures, including rate limiting.

Remediation

Disable or limit queries batching in your GraphQL engine.

GraphQL Specific

Apollo

Disable query batching in ApolloServer constructor options.

Install our open source package GraphQL Armor for Apollo.

Otherwise, you can switch off batching in the ApolloServer constructor options.

const server = new ApolloServer({
...
allowBatchedHttpRequests: false,
)}

Source: https://www.apollographql.com/docs/apollo-server/requests/#batching

Graphqlyoga

Install our open source package GraphQL Armor for Yoga.

Configuration

Identifier: resource_limitation/graphql_batch_limit

Options

  • threshold : Maximum number of batched documents allowed to be sent

Examples

Ignore this check

{
"checks": {
"resource_limitation/graphql_batch_limit": {
"skip": true
}
}
}

Score

  • Escape Severity: LOW
    • OWASP: API8:2023
    • PCI DSS: 6.5.8
    • CWE
      • 20
      • 400
      • 664
      • 770
      • 799
    • WASC: WASC-10

CVSS

  • CVSS_VECTOR: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:H/RL:O/RC:R
  • CVSS_SCORE: 4.9

References