PRODUCT DATASHEET

GraphQL Inspection

Visibility and protection for your GraphQL APIs
The evolution of API development has played a key role in the explosive growth ofdynamic applications. Organizations are seeking more efficient ways to speed up
release cycles, and this velocity is changing the CI/CD pipeline, from how releases
are organized (from waterfall to agile development, for example) all the way down
to the architecture level.
While REST and SOAP have played a major role in how APIs are written, GraphQL
is quickly becoming a developer favorite for its efficiency, speed, and specificity.
The Fastly Next-Gen WAF (powered by Signal Sciences) provides advanced
protection for your applications, APIs, and microservices, wherever they live, froma single unified solution. With the addition of GraphQL Inspection, we can provide
complete coverage over your APIs, no matter what architecture or specification
your developers use.

•Setting a new standard for API Protection
The strength of GraphQL over REST is that it allows the caller to request theexact information they need without returning any extraneous data. And thisis done with a single call instead of making multiple roundtrips to the backend
which decreases overall server strain.
The increased adoption of the open-source query language GraphQL
demonstrates how developers are moving away from REST-based APIs toa specification that is faster and more efficient. While this provides a better
experience for both developers and the end-users, GraphQL is still subject toOWASP API Top 10 attacks, as well as GraphQL-specific exploits.

US: sales@fastly.com EMEA: team-emea-sales@fastly.com APAC: apac-sales@fastly.com +1.844.4FASTLY© 2022 Fastly, Inc. All Rights ReservedFastly for GraphQL Inspection

2

The Fastly Next-Gen WAF offers coverage that blocks OWASP-style injection
attacks, denial of service attacks, and other vulnerabilities that can target
GraphQL APIs. GraphQL Inspection gives your teams the ability to adopt
newer technologies without taking on additional application security risk. With
over 90% of customers in full blocking mode, we provide comprehensive API
protection that doesn’t break your application or block legitimate requests.

While REST has set
the standard for API
development overthe past two decades,organizations are• Key benefitsIncreased API attack visibility and coverage

As your organization increases its application footprint, the Fastly Next-Gen

quickly adopting
GraphQL as a more
efficient way to makecalls that power theirapplications.

WAF provides scalable and comprehensive protection across all of your Layer
7 assets with full feature parity. Teams can apply their existing WAF rules toGraphQL requests and block attacks, or create custom rules to specificallyhandle GraphQL traffic.
Protection where your developers are

Help your developers to deploy applications using the tools they want, withoutslowing down release cycles. GraphQL Inspection allows organizations to write
APIs safely while giving development teams the freedom and flexibility to workwithin the languages that fit into their workflows.
Operational efficiency

GraphQL Inspection enables organizations to reap the benefits of GraphQL’s
efficiency improvements without putting their applications at risk.

•Blocking GraphQL attacks
GraphQL Inspection for the Fastly Next-Gen WAF offers several ways fororganizations to take advantage of our patented approach to security:Automation

As a part of our out-of-the-box solution, GraphQL Inspection will parseGraphQL requests and inspect the contents of the request within context. Ifan OWASP-style attack is present, we will block it automatically without any
additional setup and configuration required.

US: sales@fastly.com EMEA: team-emea-sales@fastly.com APAC: apac-sales@fastly.com +1.844.4FASTLY© 2022 Fastly, Inc. All Rights ReservedFastly for GraphQL Inspection

3Custom Signals

Fastly provides GraphQL-specific signals in the console for customized
protection based on user configuration. With these signals, you can define
rules to route requests when certain thresholds or events happen. Some ofthese signals are included below.
Templated Rules

Includes a templated rule around requests for a GraphQL IDE. GraphQLattacks are now visible via the console.

Image1

Image2

1: Signals, including GraphQL-specific Signals, can be used to create a Request, Rate Limit or Exclusion rules to a Corp or Site
2: Example of creating a Request Rule using a GraphQL Max Depth Signal to block traffic to avoid misuse or an attack

What is a signal?
A signal is a descriptive tag about a request. It makes certain characteristics of the request visible andapparent – this includes what types of attack payloads a request contains or whether the request wasblocked.

US: sales@fastly.com EMEA: team-emea-sales@fastly.com APAC: apac-sales@fastly.com +1.844.4FASTLY© 2022 Fastly, Inc. All Rights ReservedFastly for GraphQL Inspection

4

Common GraphQL Vulnerabilities and Anomaly Signal Examples

Injection Attacks
OWASP API Security Top 10• SQL Injection(Distributed) Denial of ServiceBroken Access Controls

Max Depth - complex queries

Introspection - public data

Unused variables - sign ofthat crash servers

exposure through queries

an attack within request• Command Injection• Server-side• Request Forgery

GraphQL-specificGetting started
API security must be part of any strategic security plan. Fastly’s Next-Gen WAF is the only
web application and API protection platform that defends against a wide variety of API threats,
across major API security categories and across established and newer API architectures.
To learn more about our security solutions, visit us at fastly.com/secure or contact usat sales@fastly.com.

US: sales@fastly.com EMEA: team-emea-sales@fastly.com APAC: apac-sales@fastly.com +1.844.4FASTLY© 2022 Fastly, Inc. All Rights Reserved