@codemod/apollo-graphql-v4-fix-csrf-prevention-false
A security-focused codemod that fixes vulnerable Apollo Server v4 configurations by changing explicitly disabled csrfPrevention option from false to true.
Security Context
Apollo GraphQL v4 applications with csrfPrevention explicitly set to false are vulnerable to CSRF (Cross-Site Request Forgery) attacks. This setting disables Apollo Server's built-in CSRF protection mechanism, leaving the application exposed to attacks where malicious websites can make unauthorized GraphQL requests on behalf of authenticated users.
Severity: Critical
CWE: CWE-352 - Cross-Site Request Forgery (CSRF)
CVE: CVE-2023-26144
What This Codemod Does
This codemod finds all instances where csrfPrevention is explicitly set to false in Apollo Server configurations and changes them to true to enable CSRF protection.
Before
After
Supported Patterns
The codemod handles various configuration patterns:
- Direct ApolloServer constructor configurations
- Configuration objects passed to ApolloServer
- Multi-line configurations with mixed properties
- Configurations using spread syntax
Installation & Usage
What Gets Changed
✅ Transforms:
csrfPrevention: false→csrfPrevention: true- Applies to any object containing this property/value pair
- Preserves all other configuration options and formatting
❌ Does NOT transform:
- Properties already set to
true - Configurations without
csrfPreventionproperty - Commented-out configurations
- Different property names (e.g.,
csrf: false) - Environment variable-based conditional settings
Security Impact
Enabling CSRF prevention helps protect against:
- Cross-site request forgery attacks
- Unauthorized GraphQL operations from malicious websites
- Session hijacking through forged requests
References
- Apollo Server Security - CSRF Prevention
- Apollo Server v4 Migration Guide
- OWASP CSRF Prevention
- CWE-352: Cross-Site Request Forgery
Development
License
MIT