Skip to content
This repository was archived by the owner on Oct 25, 2021. It is now read-only.
This repository was archived by the owner on Oct 25, 2021. It is now read-only.

Provide configuration to disable the GET HTTP method, and consider disabling it by default #28

Closed
@mcohen75

Description

@mcohen75

Since a GraphQL query can contain mutations, allowing the GET HTTP method opens the door for CSRF attacks in certain configurations.

When GET is allowed for APIs that use HTTP Cookies, a malicious actor can trick another user into clicking a link containing a GraphQL query that mutates state. Of course it’s important to note that disallowing GET is not sufficient to prevent all CSRF attacks.

See the Get Scenario on OWASP's CSRF article for more details.

For an API to be susceptible to this type of attack:

  1. CORS must be configured to allow credentials.
  2. CORS must be configured to allow all origins.
  3. Authentication must be accomplished via HTTP Cookies.

1 and 2 are very common for APIs. 3 is less common (and a bad idea) but still used.

Since GraphQL clients tend to prefer the POST method, disabling the GET method is possible with little (no?) fallout.

Are the project maintainers open to this change? If so I am willing to do the work.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions