GraphQL Introspection Leak
GraphQL introspection allows clients to query the entire API schema. When enabled in production, it exposes all types, fields, mutations, and subscriptions to attackers, providing a complete roadmap for exploitation.
Overview
GraphQL introspection is a powerful feature that allows developers to query the API for its entire schema. While essential during development, leaving introspection enabled in production gives attackers a complete blueprint of your API including all queries, mutations, subscriptions, types, and fields.
Types & Variants
Full Schema Exposure
Attackers can query __schema to retrieve every type and operation.
Field Enumeration
Even without full introspection, error messages may suggest valid field names.
Impact
Complete API schema exposure, accelerated vulnerability discovery, information disclosure about internal data models.
Examples
Introspection Query
{
__schema {
types { name fields { name } }
queryType { name }
mutationType { name }
}
}Remediation
Disable introspection in production environments. In Apollo Server, set introspection: false for production. If introspection is needed, restrict it to authenticated admin users only.
Disable introspection in production (introspection: false)
Use allowlist-based persisted queries
Implement field-level authorization
Monitor for introspection attempts
Related SuperClue scanner checks
These scanner checks look for signs of GraphQL Introspection Leak. What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works