A security-focused codemod that fixes vulnerable Apollo Server v4 configurations by changing explicitly disabled csrfPrevention option from false to true.
Security Context
Apollo GraphQL v4 applications with csrfPrevention explicitly set to false are vulnerable to CSRF (Cross-Site Request Forgery) attacks. This setting disables Apollo Server's built-in CSRF protection mechanism, leaving the application exposed to attacks where malicious websites can make unauthorized GraphQL requests on behalf of authenticated users.
This codemod finds all instances where csrfPrevention is explicitly set to false in Apollo Server configurations and changes them to true to enable CSRF protection.
Before
javascript
const server = new ApolloServer({
typeDefs,
resolvers,
csrfPrevention: false // Vulnerable!
});
After
javascript
const server = new ApolloServer({
typeDefs,
resolvers,
csrfPrevention: true // Secure!
});
Supported Patterns
The codemod handles various configuration patterns:
Direct ApolloServer constructor configurations
Configuration objects passed to ApolloServer
Multi-line configurations with mixed properties
Configurations using spread syntax
Installation & Usage
bash
# Run directly with codemod CLI
npx codemod @codemod/apollo-graphql-v4-fix-csrf-prevention-false
# Or install and run locally
npm install -g @codemod/apollo-graphql-v4-fix-csrf-prevention-false
codemod run -w workflow.yaml
What Gets Changed
✅ Transforms:
csrfPrevention: false → csrfPrevention: true
Applies to any object containing this property/value pair
Preserves all other configuration options and formatting
❌ Does NOT transform:
Properties already set to true
Configurations without csrfPrevention property
Commented-out configurations
Different property names (e.g., csrf: false)
Environment variable-based conditional settings
Security Impact
Enabling CSRF prevention helps protect against:
Cross-site request forgery attacks
Unauthorized GraphQL operations from malicious websites