Apollo GraphQL Server Lacks CSRF Prevention
Description
The Apollo GraphQL server lacks the 'csrfPrevention' option, which can enable CSRF attacks. By default, this option is 'false' in v3 of the Apollo GraphQL server.
Examples
Insecure Code
js
new ApolloServer({})Secure Code
js
new ApolloServer({ csrfPrevention: true })Remediation
Add 'csrfPrevention: true' to the ApolloServer options to prevent CSRF attacks.
Rule Details
| Field | Value |
|---|---|
| ID | CODE-0654 |
| Category | Web |
| Severity | HIGH |
| CWE | CWE-352 |
| Confidence | HIGH |
| Impact | MEDIUM |
| Likelihood | MEDIUM |
| Exploitability | EASY |
| Tags | csrf, apollo-graphql |
| OWASP | N/A |