Skip to content
SelfSec
Join the launch listLaunch list
SelfSec
Vulnerability field guide

GraphQL

GraphQL hands clients a flexible query language — and hands attackers a map of your whole schema if you let it. Here is how introspection, query abuse and missing authorization go wrong, and how to lock the endpoint down.

4 articles 17 min total Overview to advanced techniques

Start with the overview

GraphQL4 min read

GraphQL API Security: Introspection, Deep Queries and the Authorization Gap

GraphQL hands clients a flexible query language — and hands attackers a map of your whole schema if you let it. Here is how introspection, query abuse and missing authorization go wrong, and how to lock the endpoint down.

Read the overview

GraphQL techniques

3 focused deep-dives
  1. 02 Broken AuthorizationBroken Object-Level Authorization in GraphQL Resolvers 5 min
  2. 03 Denial of ServiceGraphQL Denial of Service: Deeply Nested and Aliased Queries 4 min
  3. 04 IntrospectionGraphQL Introspection: Mapping a Hidden Schema in One Query 4 min