GraphQL Security Issues
GraphQL APIs may expose introspection queries in production, allowing attackers to discover the entire schema including types, fields, mutations, and relationships. Combined with other vulnerabilities, this accelerates exploitation.
Overview
GraphQL provides powerful querying capabilities but introduces unique security challenges. Enabled introspection allows anyone to discover the entire API schema. Nested queries can cause denial of service. Batch queries can bypass rate limits. Field-level authorization is often missing, and error messages can leak implementation details.
Types & Variants
Introspection Abuse
Using __schema and __type queries to map the entire API surface.
Query Depth Attacks
Crafting deeply nested queries to exhaust server resources.
Batch Query Abuse
Sending multiple operations in a single request to bypass rate limiting.
Impact
Schema disclosure, query complexity attacks (DoS), batch query abuse, authorization bypass, data harvesting.
Examples
Introspection Query
{ __schema { types { name fields { name type { name } } } } }Remediation
Disable introspection in production, implement query depth and complexity limits, use query allowlisting, enforce per-field authorization, and rate limit queries.
Disable introspection in production environments
Implement query depth and complexity limits
Use persisted/allowlisted queries
Apply authorization at the field resolver level
Rate limit GraphQL operations independently
Related SuperClue scanner checks
These scanner checks look for signs of GraphQL Security Issues. What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works