graphql-yoga.md

graphql-yoga

Table of Contents

• About
• Security Considerations
• Request Validations
• Notable Vulnerabilities
• Security Disclosure

About

Language: typescript
Source: https://github.com/dotansimha/graphql-yoga
Documentation: https://www.graphql-yoga.com/

Security Considerations

graphql-yoga provides the following features which should be taken into consideration:

Field Suggestions	Query Depth Limit	Query Cost Analysis	Automatic Persisted Queries	Introspection	Debug Mode	Batch Requests
✅ Enabled by Default	⚠️ Disabled by Default	❌ No Support	❌ No Support	⚠️ Disabled by Default	⚠️ Disabled by Default	⚠️ Disabled by Default

Request Validations

Total Validation Count: 34

graphql-yoga is based on apollo and graphql-js which validates the following checks when a query is sent:

Document Validations	Operation Validations	Field Validations	Argument Validations	Fragment Validations	Value Validations	Directive Validations	Variable Validations	Misc. Validations
Executable Definitions	Lone Anonymous Operation	Fields On Correct Type	Known Argument Names	Fragments On Composite Types	Known Type Names	Known Directives	No Undefined Variables
Lone Schema Definition	Unique Operation Names	Overlapping Fields Can Be Merged	Provided Required Arguments	Known Fragment Names	Possible Type Extensions	Unique Directive Names	No Unused Variables
	Unique Operation Types	Scalar Leafs	Unique Argument Definition Names	No Fragment Cycles	Unique Enum Value Names	Unique Directives Per Location	Unique Variable Names
		Single Field Subscriptions	Unique Argument Names	No Unused Fragments	Unique Type Names		Variables Are Input Types
		Unique Field Definition Names		Possible Fragment Spreads	Values Of Correct Type		Variables In Allowed Position
				Unique Fragment Names	Unique Input Field Names

Security Disclosure

https://github.com/dotansimha/graphql-yoga