GraphQL security testing
GraphQL gives clients a flexible query language over a single endpoint. That flexibility changes the security picture: one endpoint can expose your entire data model, and one query can ask for a very large amount of work.
How it works
Introspection, if left on, lets anyone download the full schema. Deeply nested or batched queries can overload the server. Resolvers may skip authorization checks that REST endpoints enforced, and GraphQL arguments can carry injection payloads like any other input.
Why it matters
- Full schema disclosure, including internal fields.
- Denial of service through expensive queries.
- Data exposure through resolvers without proper authorization.
Best practices
- Disable introspection in production.
- Limit query depth, complexity and batching.
- Enforce authorization in every resolver.
- Validate and sanitise arguments.
How Vooki Pro helps
- Detects exposed GraphQL introspection.
- Tests for GraphQL-specific denial of service and GraphQL injection.
- Runs authorization and injection checks against GraphQL-backed APIs alongside the rest of your application.
- Reports each finding with evidence and remediation guidance.
Frequently asked questions
Should GraphQL introspection be disabled?
In production, usually yes. It exposes your full schema to anyone.
How do I prevent GraphQL DoS?
Limit query depth, complexity and batching, and apply rate limits to the endpoint.
Try Vooki Pro free for 7 days
Test your GraphQL endpoint as thoroughly as your REST APIs. The trial unlocks every feature for 7 days, and scanning runs on your own machine.
Related: Testing APIs for mass assignment · Adding DAST to your CI/CD pipeline