Re:The Complete GraphQL Security Guide
by travisd on Thursday September 02, 2021 @08:17PM
(#28399028)
I think the article does a disservice to itself by casually adding in things like "SQL injection" and a few other issues that are really not unique to GraphQL. A more concise article that only touches on the issues that are GraphQL specific would be welcome.
Beyond that, I find the authorization sections unconvincing. As someone who's spent quite a bit of time thinking about authorization in GraphQL APIs, I think that the only viable option for authorization in GraphQL is node level authorization, especially if using the relay convention. You're forced to write every authorization check as a function of the relationship between the user and the subject at hand and it avoids accidentally leaking information (which is also issue with REST APIs that do authorization at the controller level, à la https://news.ycombinator.com/item?id=25728175).
Beyond that, I find the authorization sections unconvincing. As someone who's spent quite a bit of time thinking about authorization in GraphQL APIs, I think that the only viable option for authorization in GraphQL is node level authorization, especially if using the relay convention. You're forced to write every authorization check as a function of the relationship between the user and the subject at hand and it avoids accidentally leaking information (which is also issue with REST APIs that do authorization at the controller level, à la https://news.ycombinator.com/item?id=25728175).