API Security 101: Securing GraphQL and REST Endpoints Like a Pro
1 min read
Summary
The popularity of GraphQL as an API among developers is increasing because of its flexibility, efficiency and the ability to get all required data in one request, compared to REST APIs that have come under fire for creating over-fetching and under-fetching problems that produce additional API calls and performance issues.
However, such flexibility creates additional security issues that need addressing, including increased attack surface, the absence of rate limiting, problems with data scraping, and an insecure introspection feature that reveals the API endpoint structure.
To combat these vulnerabilities, it is recommended that fields are restricted, query depth is limited and rate limiting is enforced, and OAuth and JWT are used for authentication, while RBAC and ABAC are implemented for authorisation.