GraphQL Abuse

HighAPI SecurityA01:2021 – Broken Access Control / OWASP API Security Top 10

GraphQL endpoints with introspection enabled, missing query complexity limits, or inadequate authorization checks allow attackers to enumerate the full schema, execute deeply nested queries causing denial of service, or access unauthorized data through field-level authorization bypass.

Immediate Response

1Disable introspection on production GraphQL endpoints immediately.
2Apply query depth and complexity limits to reject expensive queries.
3Implement rate limiting on GraphQL endpoints accounting for batched operations.
4Audit recent queries for evidence of unauthorized data access.

All playbooks

1Implement field-level authorization checks ensuring each field validates the requesting user's permissions.
2Deploy query cost analysis to reject or throttle queries exceeding defined complexity thresholds.
3Limit batched operations per request and apply per-operation rate limiting.
4Use persisted queries (allowlisted operations) instead of accepting arbitrary queries in production.

Long-term Prevention

1Integrate GraphQL-specific security testing into CI/CD pipelines.
2Implement schema registration and validation to prevent unauthorized schema changes.
3Deploy a GraphQL security gateway for centralized authorization and query analysis.
4Conduct regular penetration tests targeting GraphQL-specific attack vectors.

Attack vectors

Introspection queries exposing the full GraphQL schema to unauthorized users
Deeply nested or recursive queries exhausting server resources (DoS via query complexity)
Batched queries bypassing rate limits by sending multiple operations in a single request
Field-level authorization bypass accessing restricted fields through aliased queries

Indicators of compromise

Introspection queries (__schema, __type) from unauthorized clients in API logs
Abnormally long or deeply nested GraphQL queries causing elevated response times
Batched GraphQL requests with hundreds of operations in a single HTTP request
API responses returning fields that should be restricted based on user role

Tooling

GraphQL VoyagerInQL (Burp Suite extension)ClairvoyanceGraphQL ShieldEscape GraphQL Security