GraphQL Authorization Issues
High · API Security · CWE-285
Description
Resolver functions lack object-level authorization.
Root cause
Trusting client-side field selection only.
Impact
Mass data exposure via nested queries.
Detection
Introspection + IDOR-style GraphQL tests.
Mitigation
AuthZ on every resolver; query cost limits.
Secure coding
Disable introspection in prod; depth/complexity limits.
Safe lab example
lab-graphql
Practise related skills in Labs or deepen on Academy library.