New CS: GraphQL Security Cheat Sheet

[ThunderSon]

After various discussion on Slack, it is important to create a GraphQL Cheat Sheet in order to guide developers to writing secure GraphQL endpoints.

@bigshebang to provide us with a draft on work already done from their side.

@PauloASilva FYI. This should be moving properly with the API security project's line as well.

Let's see this effort through. After Luke's draft, we can modify the template and see what's missing and could be improved 😄

[mackowski]

Awesome! ;-)

[ErezYalon]

@bigshebang, is there an ETA for the draft? We (together with @PauloASilva) are starting to work on the subject as well.

[bigshebang]

@ErezYalon the ETA is now :D #434

[ThunderSon]

What @bigshebang presented is an effort already made on creating a GraphQL knowledge base. Next up is growing that to cover the defenses spectrum and tidying it up to have a sheet feeling.

[ErezYalon]

We are a small team working on several API Security projects.
We will start our GraphQL research soon and add our results to the sheet. Most will probably come from @PauloASilva.

[PauloASilva]

Hi guys,
Sorry for the late reply.

My initial comments and thoughts on how to improve the GraphQL Cheat Sheet proposal were left in the PR.

On an initial stage I think we can work on our general suggestion: make the CS more actionable, but only after hearing your thoughts about our comments.

Cheers,
Paulo A. Silva

[ThunderSon]

Thanks @PauloASilva ! We didn't provide our full feedback as well. Thanks for tackling this!
I'll add some more comments and try to get some improvements in hopefully in the weekend.

[mackowski]

I will try to review it over the weekend

[jmanico]

What is the stats? Can I help here?

[nikitastupin]

Hi there! I can describe some common vulnerabilities related to GraphQL APIs that I've found during my bug bounty journey. Also methodology of researching GraphQL APIs from bug hunter perspective.

However as far as I understand this cheatsheet intended for developers. From your perspective, is that kind of information valuable to the cheatsheet?

[mackowski]

@jmanico @nikitastupin please review this work #434 and share your thoughts.
@nikitastupin perspective of a bug hunter is very important - if you can enumerate common vulnerabilities related to GraphQL and see if we covered all of them with the mitigations/fixes in the #434 it will be awesome, if we are missing some vuln please add a comment about it.