GraphQL Introspection Abuse
A single /graphql endpoint. Use introspection to map the full schema, then query a field the UI never shows you.
GraphQL exposes one endpoint that can describe itself completely. Introspection is a legitimate developer feature and an excellent attacker map — it hands over every type, field and mutation, including the ones the interface never shows.
How to use it
- Send an introspection query against the endpoint.
- Read the full schema it returns.
- Query a field the user interface never exposes.
What to take away
One endpoint, many operations
Traditional endpoint-level access rules do not map onto GraphQL. Authorisation has to live at the field and object level.
Disabling introspection is not access control
It slows discovery down. Schemas leak through error messages, client bundles and field suggestions regardless.
Query depth is a denial-of-service vector
Nested queries can be made to explode combinatorially. Depth limits, complexity scoring and timeouts are standard defences.
Frequently asked questions
Should introspection be disabled in production?
Commonly yes, as defence in depth. It must not be your only control — every field still needs its own authorisation check.
Why do REST security tools miss GraphQL bugs?
They reason about URLs and methods. In GraphQL every request is a POST to the same path, so the interesting differences are inside the body.
Where this fits in the course
This security lab pairs with Path 21 — API Security — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- BOLA/BFLA Playground — A fake employee-directory API. Read a record that isn't yours, then call an admin-only action with no admin role at all.
- Mass Assignment Toy — A "update my profile" endpoint that binds whatever JSON you send straight to your account. Find the field that shouldn't be writable.
- IDOR Playground — A fake "my invoices" page. Change one number in the URL and see whose data you were never supposed to see.
- Rate-Limit Bypass Simulator — A login endpoint that blocks you after 3 bad guesses — but trusts a header you control to decide who "you" are.