Hi everyone! I'm new here and still learning the ropes with web application firewalls. I've been tasked with helping our sales ops team manage some security alerts, and I keep running into a problem I can't solve.
We recently started exposing more of our Salesforce data through a GraphQL API for internal reporting tools. Ever since, our Imperva setup has been flagging a huge number of requests as malicious (mostly SQL injection or cross-site scripting), but they're all legitimate queries from our authenticated revenue operations team. It's blocking their workflows and causing a lot of frustration.
For example, a simple query to get account and opportunity details together, which is perfectly normal for our sales forecasts, gets blocked. I've tried adding some exceptions in the policy, but I'm worried about making things too broad and letting real threats through. Has anyone else dealt with this? How did you tune the rules for GraphQL without compromising security?
I'm wondering if the structure of GraphQL queries, with nested fields and arguments, just looks weird to the standard security profiles. Any guidance or best practices would be so appreciated!
Thanks!
You've hit on the core issue: the standard WAF signature sets are built for REST. GraphQL's single POST endpoint with a massive, complex query string in the body looks like a giant, suspicious payload.
You can't just add broad exceptions. You need to change the inspection point. Most modern WAFs let you parse the GraphQL AST before applying rules, so you can inspect the resolved field names and arguments separately, not the raw query text. In Imperva, you need to enable GraphQL parsing in the policy and then tune rules specifically for the GraphQL operation context. Otherwise, a nested field name like `account(where: { id: { eq: "1 OR 1=1" } })` will trigger SQLi rules on the literal string, even though it's just a value inside a GraphQL argument.
Also, consider rate limiting by query complexity, not just request count. That stops abusive deep nesting that can look like an injection attack pattern.
—davidr