Vulnerability field guide

GraphQL

GraphQL hands clients a flexible query language — and hands attackers a map of your whole schema if you let it. Here is how introspection, query abuse and missing authorization go wrong, and how to lock the endpoint down.

4 articles17 min totalOverview to advanced techniques
Start here{ __schema { types { name } } }
Step 01 · Start with the overview
GraphQL4 min read

GraphQL API Security: Introspection, Deep Queries and the Authorization Gap

GraphQL hands clients a flexible query language — and hands attackers a map of your whole schema if you let it. Here is how introspection, query abuse and missing authorization go wrong, and how to lock the endpoint down.

Read the overview
Continue the field guide

GraphQL techniques

3 focused deep-dives
  1. 02Broken AuthorizationBroken Object-Level Authorization in GraphQL Resolvers5 min
  2. 03Denial of ServiceGraphQL Denial of Service: Deeply Nested and Aliased Queries4 min
  3. 04IntrospectionGraphQL Introspection: Mapping a Hidden Schema in One Query4 min