API › Module 1 › Lesson 2
GraphQL Security
What GraphQL is and how insecure schemas get abused
Opening
One endpoint, many operations
GraphQL usually exposes a single /graphql URL for queries and mutations. Clients ask for exactly the fields they need—powerful for apps, dangerous if authorization is missing per field.
1. How GraphQL works
A schema defines types, queries (read), and mutations (write). Clients send a document with fields, arguments, variables, aliases, and fragments. Subscriptions stream updates over WebSockets on some stacks.
2. Common GraphQL risks
Missing authz on nested fields
You can query user { email } for any id if resolvers skip ownership checks.
Unsanitized arguments
IDs and filters passed into SQL/ORM without checks become injection or IDOR.
Batching / aliases
Many aliased operations in one HTTP call can bypass naive rate limits.
CSRF over GraphQL
Cookie-authenticated GraphQL POSTs can be forged like classic CSRF if tokens are absent.
Cyberlium rule
Practice GraphQL attacks only on Cyberlium labs or apps you own. Production hunting needs permission.
Knowledge Check
GraphQL mutations are primarily for:
Multiple choice