As a GraphQL API gives you a lot of extra power and possibilities, it also introduces some new attack vectors. Nothing prevents the user of your (web) application to open the developer console and start creating and sending other queries to your GraphQL backend. By using the authentication token already available, he/she can call your API. So without further mitigations a user can create and run any query he/she can think of.
Luckily there are multiple ways to control this attack vector. I already talked about
- Assigning a complexity budget.
- Limiting the query depth.
- Adding authorization
- Persisted queries
In this last post I focus on a small but important attack vector; introspection.
What is introspection?
GraphQL has a built-in introspection system that allows you to ask a GraphQL schema for information. This is one of the things that makes GraphQL so powerful and enables rich tooling integration.
If you against the following query against your GraphQL API:
you get a part of the metadata back:
Of course an attacker can also use this to request all details about our GraphQL server looking at possible ways to abuse this.
How to disable introspection in HotChocolate?
To disable introspection we need to update our GraphQL server configuration:
Remark: Typically we enable this only for production.
If we now try to use an introspection query, we get the following error message: