Apollo Server and CSRF protection.

[frederikhors]

Guys,

I am really sad not seeing any results in these issues if I look for the word: "CSRF".

I read a lot around:

1. https://github.com/pillarjs/understanding-csrf
2. https://security.stackexchange.com/questions/10227/csrf-with-json-post
3. https://stackoverflow.com/questions/11008469/are-json-web-services-vulnerable-to-csrf-attacks
4. (Nothing on the ApolloServer site: https://www.apollographql.com/docs/apollo-server/)

However, I am not yet able to understand if our endpoint ("/graphql") is protected for this type of attack or if it is necessary to protect it with solutions like this: https://github.com/expressjs/csurf.

The thing that is not clear to me is that here: https://github.com/pillarjs/understanding-csrf they say:

When you're using CSRF tokens incorrectly:
...
Adding them to JSON AJAX calls
As noted above, if you do not support CORS and your APIs are strictly JSON, there is absolutely no point in adding CSRF tokens to your AJAX calls.

If we restrict our endpoint to just use Content-Type: application/json are we safe?

[demeralde]

Maybe this will help: https://security.stackexchange.com/questions/166724/should-i-use-csrf-protection-on-rest-api-endpoints

[vroad]

There was a vulnerability in Flash player that allowed bypassing CSRF protection with Content-Type: application/json.

https://security.stackexchange.com/questions/170477/csrf-with-json-post-when-content-type-must-be-application-json

According to the author it's fixed in all modern browsers, and only works on IE with File URI (but not with http/https).

[abernix]

Apollo Server isn't unlike any other server in this regard, and as noted in the original body, barring any browser-based bugs (which, let's be honest, the underlying security model here leans on heavily, outside of Apollo Server), limiting usage to application/json is a great practice to enforce for any API where user-based session information is shared on the same domain (e.g. cookies, etc.).

Depending on exactly what server integration is (e.g. Hapi, Koa, etc) at play, along with what other middleware (besides Apollo) are in use, you should take precautions to ensure that you are not subjected to the risks of CSRF. Keep in mind that if you wish to only accept application/json, you should disable uploads using uploads: false, since graphql-upload requires accepting multipart/form-data to accommodate the uploads.