# Graphql API Security

GraphQL API security testing covering introspection, field-level authorization...

- Repository: https://github.com/xalgorix/xalgorix (1285 stars)
- Category: Testing
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add xalgorix/xalgorix --skill graphql-api-security -g -a claude-code -y`
Codex: `npx skills add xalgorix/xalgorix --skill graphql-api-security -g -a codex -y`
Cursor: `npx skills add xalgorix/xalgorix --skill graphql-api-security -g -a cursor -y`
Gemini CLI: `npx skills add xalgorix/xalgorix --skill graphql-api-security -g -a gemini-cli -y`

## Description

GraphQL API security testing covering introspection, field-level authorization, BOLA/BFLA, batching abuse, depth/complexity attacks, mutations, and subscriptions

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# GraphQL API Security

## Purpose
Comprehensive GraphQL API testing: schema intelligence, authorization bypass, resource consumption, and mutation abuse.

## Preconditions
- A GraphQL endpoint has been identified (POST to /graphql or similar)
- At least one valid session (for authenticated queries)

## Attack Surface Signals
- POST to /graphql, /query, /api/graphql, /v1/graphql
- JSON responses with `data`/`errors` structure
- Apollo/Relay/urql client libraries in JavaScript
- `Content-Type: application/json` with `query` in the body

## Methodology

### Endpoint Discovery
```bash
for path in graphql graphql/v1 api/graphql query gql; do
  code=$(curl -sk -o /dev/null -w "%{http_code}" -X POST "https://TARGET/$path" \
    -H "Content-Type: application/json" -d '{"query":"{__typename}"}')
  [ "$code" = "200" ] && echo "[GRAPHQL] /$path"
done
```

### Introspection (Reconnaissance, NOT a standalone vulnerability)
```bash
curl -sk -X POST "https://TARGET/graphql" \
  -H "Content-Type: application/json" \
  -d '{"query":"{__schema{types{name fields{name type{name}}}}}"}' | jq .
```

Introspection is attack-surface intelligence. Report it only when combined with a separately confirmed access-control or data-exposure issue. If introspection reveals admin-only types or mutation names, use them for BOLA/BFLA testing below.

### BOLA (Object-Level Authorization)
```bash
# Query for another user's data by ID
curl -sk -X POST "https://TARGET/graphql" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer USER_A_TOKEN" \
  -d '{"query":"{user(id:\\"USER_B_ID\\"){email role passwordHash}}"}'
```

### BFLA (Function-Level Authorization)
```bash
# Try admin-only mutations with a regular user token
curl -sk -X POST "https://TARGET/graphql" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer USER_TOKEN" \
  -d '{"query":"mutation{deleteUser(id:\\"123\\"){success}}"}'
```

The rest: https://github.com/xalgorix/xalgorix/blob/HEAD/internal/tools/skills/data/api-security/graphql-api-security/SKILL.md