CSRF Protection Disabled in Apollo GraphQL Server
Description
The Apollo GraphQL server has CSRF protection disabled by setting the 'csrfPrevention' option to false, making it vulnerable to Cross-Site Request Forgery (CSRF) attacks.
Examples
Insecure Code
js
new ApolloServer({ csrfPrevention: false })Secure Code
js
new ApolloServer({ csrfPrevention: true })Remediation
Enable CSRF protection by setting 'csrfPrevention' to true.
Rule Details
| Field | Value |
|---|---|
| ID | CODE-0210 |
| Category | Web |
| Severity | HIGH |
| CWE | CWE-352 |
| Confidence | HIGH |
| Impact | MEDIUM |
| Likelihood | MEDIUM |
| Exploitability | EASY |
| Tags | csrf, apollo-graphql |
| OWASP | N/A |