Attacking GraphQL

GraphQL moves authorization from routes to resolvers, and most teams do not move their access control with it. The REST habit of protecting /admin/* has no equivalent when every operation arrives at one endpoint — so the recurring finding is not an exotic GraphQL bug, it is an ordinary authorization failure on a field nobody thought to guard.

When to Use

• The target exposes /graphql, /graphiql, /v1/graphql, /api/graphql
• Request bodies contain query, mutation, subscription, or operationName
• Responses have the {"data": ..., "errors": [...]} envelope
• A mobile or SPA client posts GraphQL to a backend
• You need to map an API whose schema you do not have

When NOT to Use