Later archive addition

GraphQL Batching Attacks

wlrmblog and @Wallarm · Wallarm · 13 December 2019

The article shows how GraphQL batching can pack thousands of operations into one HTTP request, undermining request-based rate limits and monitoring. Examples use batched login and OTP mutations to amplify brute force and bypass authentication controls, with mitigations focused on per-operation limits and business-logic checks.

Record

Researcher

wlrmblog and @Wallarm

Published by

Wallarm

Date

13 December 2019

In the archive

• Added to the 2019 archive after the original list was published

Tags

• graphql
• auth-bypass
• abuse-of-functionality
• owasp-a01-2021
• owasp-a04-2021

This page is the archive's own catalogue record. The research is the work of wlrmblog and @Wallarm, first published at the original source. Preserved copies are kept so the citation survives its host.