GraphQL
V13.4.1
Verify that a query allow list or a combination of depth limiting and amount limiting is used to prevent GraphQL or data layer expression Denial of Service (DoS) as a result of expensive, nested queries. For more advanced scenarios, query cost analysis should be used.
Level 1 required: False
Level 2 required: True
Level 3 required: True
CWE: 770
V13.4.2
Verify that GraphQL or other data layer authorization logic should be implemented at the business logic layer instead of the GraphQL layer.
Level 1 required: False
Level 2 required: True
Level 3 required: True
CWE: 285
Disclaimer:
Credit via OWASP ASVS. For more information visit The OWASP ASVS Project or Github respository.. OWASP ASVS is under the Creative Commons Attribution-Share Alike v3.0 license.
Loading comments 0%