Skip to main content

03. GraphQL & gRPC Security

As engineering teams adopt GraphQL for flexible data querying and gRPC for low-latency microservice communications, security models must adapt beyond traditional REST HTTP verb and endpoint patterns. Both protocols introduce unique architectural attack surfaces that require protocol-specific hardening.

1. GraphQL Security Architecture​

Unlike REST APIs that expose discrete endpoints (/api/v1/users, /api/v1/orders), GraphQL operates through a single endpoint (typically /graphql), processing flexible query payloads against a unified Abstract Syntax Tree (AST).

A. Introspection Disclosure & Schema Hardening​

GraphQL introspection enables clients to query __schema and __type meta-fields, retrieving the complete object schema, input parameters, hidden admin fields, and deprecated queries.

GraphQL Introspection Exploit Payload​

# Introspection Query to map complete backend schema
query IntrospectSchema {
  __schema {
    queryType { name }
    mutationType { name }
    types {
      name
      kind
      fields {
        name
        type { name kind }
        args { name type { name } }
      }
    }
  }
}

[!WARNING] While introspection is invaluable during development, leaving it enabled in production exposes internal data structures, administrative mutations, and unreleased feature flags to adversaries.

Production Introspection Disabling Code​

Node.js (Apollo Server v4)​
import { ApolloServer } from '@apollo/server';
import { ApolloServerPluginDisableIntrospection } from '@apollo/server/plugin/disableIntrospection';

const server = new ApolloServer({
  typeDefs,
  resolvers,
  // Disable introspection conditionally in production
  plugins: process.env.NODE_ENV === 'production' 
    ? [ApolloServerPluginDisableIntrospection()] 
    : [],
});
Python (Strawberry GraphQL / FastAPI)​
from strawberry.fastapi import GraphQLRouter
import strawberry

@strawberry.type
class Query:
    @strawberry.field
    def hello(self) -> str:
        return "Hello World"

schema = strawberry.Schema(query=Query)

# Disable introspection in production environment
graphql_app = GraphQLRouter(
    schema,
    introspection=process.env.get("ENV") != "production"
)
Go (gqlgen)​
package main

import (
    "github.com/99designs/gqlgen/graphql/handler"
    "github.com/99designs/gqlgen/graphql/handler/extension"
)

func NewGraphQLHandler(es graphql.ExecutableSchema, isProd bool) *handler.Server {
    srv := handler.NewDefaultServer(es)
    if isProd {
        // Introspection is enabled by default in gqlgen; remove or block plugin
        // Do not add srv.Use(extension.Introspection{}) in production!
    } else {
        srv.Use(extension.Introspection{})
    }
    return srv
}
Java (Spring Boot GraphQL)​
# application.yml - Disable Introspection in Production
spring:
  graphql:
    schema:
      introspection:
        enabled: false # Set to false for production profile

B. Query Depth & Complexity DoS Attacks​

Because GraphQL fields can be recursively nested, an attacker can submit a deeply nested query causing server CPU and memory exhaustion:

# Recursive Query Depth DoS Payload
query RecursiveDoS {
  user {
    friends {
      friends {
        friends {
          friends {
            friends {
              name
            }
          }
        }
      }
    }
  }
}

Query Depth & Cost Calculation Solutions​

  1. Depth Limiting: Restricts the maximum nesting level of a query (e.g., max depth = 5).
  2. Complexity Analysis: Assigns a numeric cost to each field (e.g., scalar fields = 1, collection fields = 10 multiplied by first/limit arguments).
Node.js Depth Limiting (graphql-depth-limit)​
import depthLimit from 'graphql-depth-limit';
import { ApolloServer } from '@apollo/server';

const server = new ApolloServer({
  typeDefs,
  resolvers,
  validationRules: [
    depthLimit(5, { ignore: ['_id'] }) // Enforce maximum depth of 5
  ]
});
Go Depth & Complexity Limiting (gqlgen)​
import (
    "github.com/99designs/gqlgen/graphql/handler"
    "github.com/99designs/gqlgen/graphql/handler/extension"
)

func ConfigureServer(es graphql.ExecutableSchema) *handler.Server {
    srv := handler.NewDefaultServer(es)
    
    // 1. Enforce Max Query Depth
    srv.Use(extension.FixedComplexityLimit(200)) // Max cost score
    
    return srv
}
Python Complexity Guard (graphene-django / strawberry)​
from strawberry.extensions import MaxTokensLimiter, MaxAliasesLimiter

schema = strawberry.Schema(
    query=Query,
    extensions=[
        MaxTokensLimiter(max_tokens=1000),
        MaxAliasesLimiter(max_aliases=10),
    ]
)

C. GraphQL Batching Attacks​

GraphQL supports query batching via HTTP Array Batching or Alias Batching. Attackers use batching to execute hundreds of operations in a single HTTP request, effectively bypassing IP-based rate limiters and Web Application Firewalls (WAFs).

Traditional REST Auth Request:
1 HTTP Request = 1 Login Attempt (Trigger Rate Limiter after 5 attempts)

GraphQL Alias Batching Attack:
1 HTTP Request = 1,000 Login Attempts (Bypasses IP Rate Limiting!)
# Alias Batching Attack Payload - Bypassing Rate Limits
mutation BruteForceMFA {
  attempt1: verifyMFA(code: "0001") { success token }
  attempt2: verifyMFA(code: "0002") { success token }
  attempt3: verifyMFA(code: "0003") { success token }
  # ... Up to 1,000 aliases in a single HTTP POST request
}

[!CAUTION] Mitigation for Batching Attacks:

  1. Disable HTTP Array Batching at the API Gateway or GraphQL engine middleware.
  2. Enforce a strict Max Alias Limit (e.g., maximum 5 aliases per query).
  3. Enforce cost analysis that multiplies complexity per alias executed.

2. gRPC & Protocol Buffers Security​

gRPC uses HTTP/2 as its transport protocol and Protocol Buffers (Protobuf) as its binary serialization mechanism, offering performance advantages over REST/JSON. However, HTTP/2 framing and binary serialization present unique security considerations.

┌─────────────────────────────────────────────────────────────────────────────┐
│                           gRPC SECURITY STACK                               │
├─────────────────────────────────────────────────────────────────────────────┤
│ Application Layer  ──► Protobuf Messages (Field validation, sanitization)   │
│ Context / Auth     ──► Metadata Interceptors (JWT Bearer Token / OAuth2)    │
│ Transport Layer    ──► HTTP/2 Framing (Multiplexing, Flow Control, Headers) │
│ Encryption Layer   ──► Mutual TLS (mTLS) with SAN / SPIFFE Verification    │
└─────────────────────────────────────────────────────────────────────────────┘

A. gRPC Metadata Authentication Interceptors​

In gRPC, authorization credentials (such as OAuth2 access tokens or JWTs) are transmitted inside gRPC Metadata (HTTP/2 header key-value pairs). Servers must enforce unary and streaming server interceptors to validate tokens before handling requests.

Go gRPC Unary Server Interceptor​

package interceptors

import (
    "context"
    "strings"
    "google.golang.org/grpc"
    "google.golang.org/grpc/codes"
    "google.golang.org/grpc/metadata"
    "google.golang.org/grpc/status"
)

// UnaryAuthInterceptor validates JWT in gRPC incoming metadata
func UnaryAuthInterceptor(
    ctx context.Context,
    req interface{},
    info *grpc.UnaryServerInfo,
    handler grpc.UnaryHandler,
) (interface{}, error) {
    
    md, ok := metadata.FromIncomingContext(ctx)
    if !ok {
        return nil, status.Errorf(codes.Unauthenticated, "Missing metadata context")
    }

    values := md["authorization"]
    if len(values) == 0 {
        return nil, status.Errorf(codes.Unauthenticated, "Missing authorization token")
    }

    tokenStr := strings.TrimPrefix(values[0], "Bearer ")
    userClaims, err := validateJWTToken(tokenStr)
    if err != nil {
        return nil, status.Errorf(codes.Unauthenticated, "Invalid or expired token: %v", err)
    }

    // Attach validated claims to context for downstream handlers
    newCtx := context.WithValue(ctx, "userClaims", userClaims)
    return handler(newCtx, req)
}

Java gRPC ServerInterceptor (Spring Boot / gRPC Java)​

package com.appsec.grpc.interceptor;

import io.grpc.*;
import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;

public class JwtServerInterceptor implements ServerInterceptor {

    private static final Metadata.Key<String> AUTHORIZATION_METADATA_KEY =
            Metadata.Key.of("authorization", Metadata.ASCII_STRING_MARSHALLER);

    @Override
    public <ReqT, RespT> ServerCall.Listener<ReqT> interceptCall(
            ServerCall<ReqT, RespT> call,
            Metadata headers,
            ServerCallHandler<ReqT, RespT> next) {

        String authHeader = headers.get(AUTHORIZATION_METADATA_KEY);
        if (authHeader == null || !authHeader.startsWith("Bearer ")) {
            call.close(Status.UNAUTHENTICATED.withDescription("Missing Bearer token"), headers);
            return new ServerCall.Listener<ReqT>() {};
        }

        String token = authHeader.substring(7);
        try {
            Claims claims = validateToken(token);
            Context context = Context.current().withValue(USER_CLAIMS_KEY, claims);
            return Contexts.interceptCall(context, call, headers, next);
        } catch (Exception e) {
            call.close(Status.UNAUTHENTICATED.withDescription("Invalid JWT Token"), headers);
            return new ServerCall.Listener<ReqT>() {};
        }
    }
}

B. Mutual TLS (mTLS) for gRPC Channels​

Because gRPC relies heavily on inter-service microservice communication, enforcing Mutual TLS (mTLS) ensures that both client and server authenticate each other's X.509 certificates before initiating gRPC streams.

Go gRPC Server with mTLS Configuration​

package main

import (
    "crypto/tls"
    "crypto/x509"
    "os"
    "google.golang.org/grpc"
    "google.golang.org/grpc/credentials"
)

func LoadTLSCredentials() (credentials.TransportCredentials, error) {
    // 1. Load Server Certificate & Key
    serverCert, err := tls.LoadX509KeyPair("server.crt", "server.key")
    if err != nil {
        return nil, err
    }

    // 2. Load CA Certificate to verify client certs
    pemClientCA, err := os.ReadFile("ca.crt")
    if err != nil {
        return nil, err
    }

    certPool := x509.NewCertPool()
    if !certPool.AppendCertsFromPEM(pemClientCA) {
        return nil, err
    }

    // 3. Create TLS config requiring Mutual TLS (RequireAndVerifyClientCert)
    config := &tls.Config{
        Certificates: []tls.Certificate{serverCert},
        ClientAuth:   tls.RequireAndVerifyClientCert,
        ClientCAs:    certPool,
        MinVersion:   tls.VersionTLS13, // Enforce TLS 1.3
    }

    return credentials.NewTLS(config), nil
}

func main() {
    creds, _ := LoadTLSCredentials()
    grpcServer := grpc.NewServer(grpc.Creds(creds))
    // Register gRPC services...
}

C. HTTP/2 Specific Vector: Rapid Reset (CVE-2023-44487)​

gRPC servers are vulnerable to HTTP/2 stream attacks, such as the HTTP/2 Rapid Reset vulnerability. Attackers send a stream of RST_STREAM frames immediately after opening HEADERS frames, causing high server CPU utilization without triggering traditional concurrent stream limiters.

[!IMPORTANT] HTTP/2 Mitigation:

  • Upgrade gRPC runtime libraries (grpc-go, grpc-java, grpc-node) to versions released after October 2023.
  • Configure MAX_CONCURRENT_STREAMS and limit the rate of incoming reset frames at the ingress load balancer (Envoy, Nginx, or AWS ALB).

Next Chapter: 04. Rate Limiting, Throttling & Auth →

Was this guide helpful?
Share this guide
𝕏 Twitterin LinkedIn↗ Reddit✉ Email