API2:2023 — Broken Authentication

Slide 14 · Scenario 1

Rate limited? Batch your requests.

OWASP Scenario #1 — GraphQL query batching to bypass brute force protection.

📄 OWASP API Security Top 10 · 2023 · API2 · Scenario 1

SETUP

The API has rate limiting. Or so it thinks.

A GraphQL API limits login attempts to 3 requests per minute per IP. The developer is confident: an attacker can only try 3 passwords per minute. Brute force is impossible.

What the developer didn't account for: GraphQL supports sending an array of mutations in a single HTTP request.

The flaw: The rate limiter counts HTTP requests. The login logic processes individual mutations. These are two different layers that don't talk to each other.

THE ATTACK

One request. 100 password attempts.

The attacker sends a single POST to /graphql containing 100 login mutations in one array. The rate limiter sees 1 request. The GraphQL resolver processes 100 login attempts.

At 3 batched requests per minute (within the rate limit), the attacker is effectively trying 300 passwords per minute. A common 4-digit PIN would fall in under 7 minutes.

Why it works: Rate limiting must count at the right layer. Counting HTTP requests isn't enough when one request can contain hundreds of operations.

← Back Scenario 2 →