GraphQL Introspection Exposure
mediumWhat is GraphQL Exposure?
GraphQL APIs with introspection enabled in production expose the entire API schema, including types, fields, queries, and mutations, to anyone who queries the endpoint.
How it works
An attacker sends an introspection query to the /graphql endpoint. The server responds with the complete schema, revealing all available queries, mutations, types, and relationships.
Impact
Full API surface enumeration, discovery of sensitive fields and mutations, identification of internal-only endpoints, and accelerated attack planning.
ShieldReport sends introspection queries to common GraphQL endpoints (/graphql, /api/graphql) and analyses the response for schema exposure.
How to fix it
Disable introspection in production. If needed for development, restrict it to authenticated internal users. Use query complexity limits and depth limiting.
Tags
Is your site vulnerable to GraphQL Exposure?
Run a free scan to find out in under 2 minutes.
Scan Now