Navigation Menu

Skip to content

Instantly share code, notes, and snippets.

@jeffrade

jeffrade/native_mobile_connecting_to_graphql_api.md

Last active March 4, 2021 20:13
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save jeffrade/f53e49471f1badd8a544e098ba75dd45 to your computer and use it in GitHub Desktop.
Save jeffrade/f53e49471f1badd8a544e098ba75dd45 to your computer and use it in GitHub Desktop.
Download ZIP
Securing Native Mobile connecting to a GraphQL API
Raw
native_mobile_connecting_to_graphql_api.md

Certificate Pinning is highly recommended. OWASP has outlined the Who, What, Why and How.

Static keys (as opposed to user generated keys with randomness) need to be, at a minimum, obfuscated away. There are many ways (and in complexity) to do this (e.g. at a minimum, Proguard for Android) and Carve Systems has a good write-up on this.

It should go without saying, but all APIs (not just GraphQL) should only be served over HTTPS and every request authenticated (e.g. HMAC and many libraries in all languages already implement this).

Common attacks on a GraphQL API with best practices and recommendations outlined here by OWASP.

A good GraphQL security audit tool here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment