String scalar in output has no minimum length defined
Issue ID: graphql-data-output-string-scalar-min-needed
Description
A string scalar used in an output position has no minimum length specified. While GraphQL ensures that the value is a string, it does not specify whether empty or trivially short values are acceptable.
For more details, see the GraphQL constraints specification.
Possible exploit scenario
Without a defined minLength or equivalent constraint, the API contract does not clearly communicate whether empty strings are valid responses. If no minimum length constraint is defined, the API may return empty strings ("") or values consisting only of whitespace.
Although this issue rarely leads to direct security exploitation, it may result in:
- Contract ambiguity for API consumers
- Inconsistent behavior across services
- Client-side validation errors
- Reduced data quality
Remediation
Define minimum length constraints for output string scalars where business logic requires non-empty values. We recommend that you:
- Use
minLength: 1or equivalent constraint when empty strings are not valid business values - Combine
minLengthwithmaxLengthfor stronger contract definition - Align constraints with documented API guarantees
- Maintain consistent scalar definitions across subgraphs in federated APIs
Explicit minimum constraints improve schema precision, contract clarity and response consistency, and it makes API response expectations explicit.