GraphQL Pen-Testing: Introspection, Batching, and Authz
GraphQL is a different shape of API and it produces a different shape of bug. The strict-endpoint-per-resource model of REST is replaced with a single endpoint and a resolver graph. Authorization moves from URL-level to resolver-level, which is where most teams get it wrong. Here is a test plan.
APIs · By Thimmagurudu Bathini · Published · 6 min read · Last reviewed
Introspection
Production GraphQL endpoints should not expose introspection. Many do. The first check is POST /graphql with the introspection query — if it returns the full schema, the attacker has a map of every type and resolver in your application.
Authorization per resolver
The classic GraphQL bug is parent-resolved-but-child-unchecked. The parent resolver authenticates the user and returns an object. A nested child resolver fetches related data without re-checking authorization. The attacker requests order { customer { creditCard } } through an endpoint they would never be allowed to call directly, and reaches data they should not see.
Batching attacks
GraphQL allows arrays of queries in a single request. Some implementations apply rate limits per-request, not per-query — so 1000 brute-force attempts become a single request. Always test for this.
Query depth and complexity
Nested queries like user { friends { friends { friends { ... } } } } can be expensive. Without complexity limits an attacker can DOS the backend with one query. Both depth limits and complexity scoring are required.
Field-level information leakage
Fragment fields that should be admin-only but are exposed to all callers. Error messages that leak internal field names or backend state. Aliased query results that bypass per-field rate limits.
Mutations and injection
GraphQL mutations are just typed RPCs. They are subject to the same input validation requirements as any other endpoint — SQLi, NoSQLi, command injection — particularly when string inputs flow into raw database queries.
See API security testing.
Written by Thimmagurudu Bathini, BERRY9 IT SERVICES PRIVATE LIMITED, Hyderabad. Questions about your own systems? Request a scoping call or call +91 86868 92922.
Plan your next security test
Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.
- +91 86868 92922
- contact@berry9.com
- H.No: 8-3-945/A/12 & 13, Sri Venkata Sai Nest Apartments, Nagarjuna Nagar Colony, Yellareddyguda, Hyderabad 500073, Telangana