MB-R095

AUTOMATED GraphQL and API exposure minimized

MB-C03 Secure Coding Practices Medium

No high-risk anonymous REST API or unauthenticated GraphQL resolver exposure detected.

Why it Matters

GraphQL and REST endpoints can reveal more functionality than intended, especially when custom modules expose schemas, debug fields, admin-only operations, or broad collection queries. Excessive exposure increases the attack surface for enumeration and data scraping.

Minimizing API exposure keeps public surfaces focused on required storefront behavior and makes authorization easier to reason about.

Verification Steps

Schema and route review

grep -RIE "schema.graphqls|webapi.xml" app/code vendor/*/*/etc 2>/dev/null
# Identify public anonymous resources and broad query surfaces

Production endpoint check

Confirm debug/test endpoints are disabled and unused APIs are not publicly reachable

Remediation / Fix Guidance

Disable unused modules or API routes that are not required in production.
Avoid anonymous access unless the endpoint is intentionally public.
Remove debug fields and internal data from GraphQL schemas.
Apply pagination, filtering limits, and authorization checks to collection endpoints.
Document public API surfaces and review them during releases.

Examples

Fail Example

<resource ref="anonymous" /> on a route returning customer/order data.
# Excessive exposure → FAIL

Pass Example

API route requires customer token or scoped admin integration and returns only required fields.
# Exposure minimized → PASS