Preventing injection attacks

Injection attacks work by exploiting vulnerabilities that arise when user input is not properly validated or sanitized. Attackers can insert malicious code as part of the input, which is then executed within the GraphQL API. This can lead to unauthorized access, data leakage, or even complete compromise of the system.

In this section, we will learn how to prevent NoSQL and SQL injection attacks.

NoSQL GraphQL injection example

NoSQL injections can pose a threat when utilizing filters with custom scalars in GraphQL. A NoSQL injection occurs when an attacker is able to manipulate the filter parameters in a way that exploits vulnerabilities in the underlying NoSQL database. This can lead to unauthorized access, data leakage, or even the execution of arbitrary code within the database.

Consider the following schema that allows users to filter their income data with a custom scalar JSON filter:

type User{
  name: String
}
type Income...