GraphQL Security Testing

This guide treats GraphQL endpoints and resolver layers as a control boundary rather than a list of attack commands. First document who owns it, who should reach it, what identity context applies, and which data or downstream systems it can affect.

• Confirmed asset owner and in-scope address or application.
• Expected clients, identities, and network zones.
• Protocol versions, encryption expectations, and authentication mode.
• Sensitive data classes and downstream dependencies.
• Monitoring owner, escalation contact, and agreed stop threshold.

1. 01

   Identify endpoints, schema owners, clients, authentication, and persisted-query policy.

2. 02

   Map object, field, resolver, mutation, and subscription authorization.

3. 03

   Create synthetic records for designated roles.

4. 04

   Record normal query depth, complexity, batching, and pagination.

curl -sS https://api.lab.example/graphql \
+  -H "Content-Type: application/json" \
+  -d '{"query":"query Health { __typename }"}'

A useful result demonstrates a broken security expectation with a reversible, low-impact test. Scanner labels and version matches are leads; validate the actual control and preserve the clean baseline beside the changed request.

1. 01

   Confirm authorization at resolver and field level using synthetic objects.

2. 02

   Test aliases, fragments, batching, and pagination within strict cost limits.

3. 03

   Verify introspection matches environment policy.

4. 04

   Check mutations and subscriptions enforce the same identity and tenant boundaries.

ASSET / ENDPOINT:
SCOPE REFERENCE:
IDENTITY / NETWORK ZONE:
BASELINE:
CONTROL TESTED:
EXPECTED RESULT:
OBSERVED RESULT:
TIMESTAMP / REQUEST ID:
SANITIZED EVIDENCE:
STOP / CLEANUP STATUS:

• Record operation name, normalized signature, cost, depth, identity, and policy outcome.
• Alert on anonymous introspection where prohibited, excessive aliases, and repeated costly failures.
• Avoid logging variables containing secrets or personal data.

Keep raw data only when it is necessary to reproduce the finding. Redact credentials, session values, customer content, internal addresses, and personal data before evidence enters a ticket or report.

• Authorize every resolver and sensitive field.
• Apply depth, complexity, timeout, pagination, and batch limits.
• Prefer allowlisted persisted operations for high-risk clients.
• Return controlled errors and test schema changes for policy regressions.