Home / Knowledge hub / GraphQL
Knowledge hub
GraphQL
One API endpoint where the client asks for exactly the fields it wants.
What it means
GraphQL is an API style. The client sends one request naming the fields it wants, and the server returns those fields and nothing else. Most implementations expose a single address, usually /graphql, which answers anything the schema allows.
Teams adopt it because the front end stops queueing behind the back end. Your server publishes the schema, so a client can ask what exists and build against it without waiting for a new endpoint.
Why it matters
One address now carries all the meaning, so older habits stop working. With a REST API you can reason about who may call /admin/invoices. With GraphQL the same URL returns a profile, an invoice or an internal flag, depending only on the query text.
OWASP puts it plainly. Validate that the requester may see or change the data, and enforce that on edges as well as nodes, or you get IDOR problems inside the graph. Authorisation has to run per field and per record. Miss one field and nothing tells you until somebody asks for it.
How it shows up
Nested queries produce the classic finding. Ask for your own order, then the customer attached to it, then that customer's other orders. Each hop reads as reasonable. The chain walks into other people's data.
Introspection deserves a look too. It lets a client ask the schema what it supports, which helps enormously in development and hands an attacker a map in production. Depth and cost limits matter as well, because one small query can ask for an enormous amount of work. We do not test for denial of service, so that part stays with your team.
Questions people ask
GraphQL, answered
Is GraphQL less secure than REST?
Not inherently. It moves the risk somewhere else. REST spreads data across many addresses, so you can reason about each one and apply rules by URL. GraphQL answers everything at one address, so the rules have to live in your resolvers.
The honest summary is that GraphQL gives you fewer free wins. Nothing about it is unsafe, and nothing about it is safe by default either.
Should I turn off introspection in production?
Usually yes. Introspection exists so tools can learn your schema, which is genuinely useful while you build. In production it publishes every type and field you have, including the ones your interface never shows.
Turning it off is not a fix for anything. It removes a convenience for whoever is poking at your API, and the missing access check is still the real problem.
Does GraphQL handle authorisation for me?
No. The specification covers how queries are shaped and answered, not who may run them. There is no built-in role model, so every server writes its own checks.
That is why access control is the whole game here. OWASP tells you to enforce it on both nodes and edges, because a field that looks harmless can hang off a record that is not yours.
Can one query take down my server?
It can. Depth and amount are both unbounded unless you bound them, so a short query can ask the server to resolve a very large graph. OWASP recommends depth limits, cost analysis or both.
Worth saying plainly: we do not run denial of service tests. Query cost limiting is a resilience job for your team, not something we will prove for you.
Will a scanner find GraphQL problems?
Partly. A scanner can find an exposed schema, an obvious injection or a missing rate limit. It struggles with the field that returns somebody else's record, because a valid query with a good response looks like the software working.
We work beside your scanner rather than in place of it. Ours logs in as each role you have and compares what came back.
Sources
Where this comes from
Related
Terms that sit next to this one
API
The part of your application other software talks to, not a person.
Authorization
Deciding what a proven user is then allowed to do.
BOLA
An API returns a record just because you asked for it by number.
IDOR
Changing an id in a request and getting back someone else's record.
Rate limiting
Capping how often something can be attempted, per user or per address.
One endpoint, how many answers?
We query your schema as each role you have, field by field, then hand you the request and the response that returned data it should not have. A pilot is $199 for 30 days on one application.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.