Skip to main content

22. GraphQL Introspection Abuse Points

In GraphQL, the schema is the API documentation itself. If introspection is enabled, an attacker can map the entire query surface. It is also a common early clue in CTFs.

Quick Checks​

  • Whether __schema and __type are accessible
  • Exposure of hidden fields or mutations intended for administrators
  • SSRF or file-read triggers in unexpected resolvers

Example Attack Flow​

  1. Collect types and fields through introspection
  2. Infer authorization branches from error messages
  3. Test for DoS with excessively nested queries and identify the limits

In production, the key is to restrict introspection or allow it only with a token, and to enforce query complexity limits.