Strategies for secure development with GraphQL

The talk targets a common gap: teams talk about security but rarely give developers practical help. The speaker organizes the material around three questions: how to find what needs protecting, how to build a secure foundation, and what to log. The examples use GraphQL, though the advice applies to most development work.

For scoping, the speaker suggests threat modeling with STRIDE, paying attention to framework-level denial of service and privilege escalation, and to mutations, where custom side effects need the closest access review. Security work should be planned like a feature, with functional tests that confirm blocked requests also log correctly and return clear responses. For the foundation, choose a well-maintained framework that patches security issues quickly, extend its base classes with safe defaults, disable superuser access, and centralize authorization in helpers and decorators so developers do not reimplement checks. Test helpers make broad coverage practical.

On logging, GraphQL's single endpoint and in-body errors make ordinary request logs weak, so the speaker favors logging the query portion without inline sensitive values. Structured JSON, timestamps, object versioning, explicit records of permission changes, and point-in-time database recovery all help reconstruct events. The talk ends with regular drills so log searches work during an incident.