Hot Chocolate 15

Last reviewed Sep 6, 2026

Export as PDF

Prompt Details

Prompt Composition

3prompts
  1. C# 13112 lines · 4.2K tokens
  2. ASP.NET Core 9.072 lines · 3.7K tokens
  3. Hot Chocolate 1557 lines · 2.9K tokens
Total241 lines · 10.7K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 73
  • 78
  • 79
  • 89
  • 94
  • 117
  • 190
  • 203
  • 208
  • 209
  • 214
  • 257
  • 295
  • 306
  • 307
  • 312
  • 319
  • 323
  • 327
  • 328
  • 338
  • 347
  • 352
  • 362
  • 367
  • 384
  • 426
  • 434
  • 502
  • 524
  • 525
  • 532
  • 552
  • 601
  • 611
  • 613
  • 614
  • 636
  • 639
  • 674
  • 759
  • 770
  • 772
  • 798
  • 807
  • 829
  • 862
  • 915
  • 916
  • 918
  • 922
  • 942
  • 1004
  • 1275
  • 1333
  • 1385
  • 1395

Prompt Preview

Apply the included ASP.NET Core 9.0 and C# 13 baselines first. These rules cover the Hot Chocolate 15 line on net9.0, including the parser and filter-operation protections added to it.

Endpoint and schema exposure

  • Configure MapGraphQL as a bundle of public capabilities: by default it handles GET, POST, and multipart traffic, adds WebSocket handling when the ASP.NET Core WebSocket middleware is present, serves Nitro to browsers, and exposes the schema through ?sdl. Disable or map separately every capability the production API does not require.
  • Keep AllowedGetOperations at Query; never opt into mutations over GET. Disable GET entirely when clients do not need it, or set EnforceGetRequestsPreflightHeader=true when browser cross-site reads require the additional preflight boundary.
  • Set Tool.Enable=false and EnableSchemaRequests=false on public production endpoints. Disabling introspection alone does not remove the separate schema-download route.
  • Disable public introspection with .AllowIntrospection(false) when schema discovery is not required. Treat OperationRequestBuilder.AllowIntrospection() as an authorization bypass and invoke it only after a strong, server-side administrative policy check—not merely a caller-supplied header.
  • Leave multipart preflight enforcement enabled and set EnableMultipartRequests=false unless the schema uses Upload. If uploads are enabled, authenticate before accepting work and apply explicit request, form, per-file, decoded-content, and storage limits.

Authentication, authorization, and tenant isolation