Vulnerability field guide
GraphQL
GraphQL hands clients a flexible query language — and hands attackers a map of your whole schema if you let it. Here is how introspection, query abuse and missing authorization go wrong, and how to lock the endpoint down.
4 articles17 min totalOverview to advanced techniques
Start here
{ __schema { types { name } } }Step 01 · Start with the overview
GraphQL4 min read
GraphQL API Security: Introspection, Deep Queries and the Authorization Gap
GraphQL hands clients a flexible query language — and hands attackers a map of your whole schema if you let it. Here is how introspection, query abuse and missing authorization go wrong, and how to lock the endpoint down.
Read the overviewContinue the field guide
3 focused deep-dives