Offensive security assessments
GraphQL
The Schema defines the capabilities of the API and represents the contract between the client and the server. It defines the types available in the API and how they can be queried and mutated.
Why it matters
OWASP API8:2023
GraphQL concentrates data access behind a single endpoint. A misconfigured schema or resolver can expose entire object graphs, enable denial of service through deep queries, or leak fields that REST would have kept hidden.
How we test it
Our operators follow a structured checklist for this topic, adapted to your API surface and authentication model.
Testing approach
- Review schema introspection exposure and whether production should disable it.
- Test query depth, complexity, and cost limits against expensive nested selections.
- Validate authorization on each resolver, not just the top-level query entry point.
- Probe batching and alias abuse for rate-limit bypass and data harvesting.
What we look for
- Introspection enabled in production revealing full type map.
- Mutations that modify objects without object-level authorization.
- Subscriptions leaking events across tenant boundaries.
- Field suggestions exposing internal or admin-only attributes.
How to fix it
Remediation guidance
- Disable introspection in production or restrict to authenticated operators.
- Enforce query depth, complexity scoring, and pagination defaults.
- Apply authorization checks in every resolver path.
Related topics
| Topic | Summary |
|---|---|
| Mass Assignment (API3:2023) | Mass Assignment happens when an API binds client-supplied JSON directly to an internal object or database model. If the binding is not filtered by an allowlist, an attacker can set fields they were never meant to control, such as role, isAdmin, verified, balance, accountid, or p… |
| Rest API | We validate this area during scoped assessments, documenting impact and remediation guidance. |