3 ms·
Curious how they handle GQL injections. Most devs using graphql have no clue what they are as the majority just cargo cults new frameworks to keep themselves bu
by gumballindie 3y ago
Curious how they handle GQL injections. Most devs using graphql have no clue what they are as the majority just cargo cults new frameworks to keep themselves busy.
- valenterry 3y agoWhat are GQL injections? You mean something like SQL injections that come through the graphql API?
- gumballindie 3y agoExactly. Suppose you have a front end system that captures user input, and then the backend communicates with another system using the input data. If not properly escaped and is concatenated then it can lead to an injection attack just like regular sql.
- valenterry 3y agoI find the terminology strange. The exact same can happen with a standard REST api. In fact, it's even more likely since there is no type system to assist there. Would you then call it REST injections too?