Articles in Web App & API Security

GraphQL Alias Batching as a Rate-Limit and IDOR Bypass Primitive

GraphQL was designed to give clients power — the power to ask for exactly what they need, composed however they like, in a single round-trip. That composability is also its security paradox.