Graphql

GraphQL APIs usually get plenty of attention around auth, query depth limits, and introspection. Transport security often gets treated like a box to check: “we already use HTTPS.” That’s not enough. If your Apollo Server is reachable over plain HTTP, or if browsers can be tricked into making the first request insecurely, HTTPS alone leaves a gap. HSTS closes that gap for browser clients by telling them: from now on, only use HTTPS for this host. ...

If you run GraphQL Yoga in production without HSTS, you’re trusting every first insecure hop a browser might take before it reaches your HTTPS endpoint. That’s a bad bet. HSTS, or HTTP Strict Transport Security, tells browsers: “stop trying plain HTTP for this site; use HTTPS only.” For a GraphQL API, that matters more than people think. GraphQL often carries auth tokens, session cookies, admin operations, and introspection data you really don’t want exposed over downgraded or intercepted connections. ...