EncryptCodecencryptcodec
Simulations/GraphQL Introspection

GraphQL Introspection

Intermediate

Use GraphQL introspection to discover the full schema, extract sensitive data through exposed fields, then disable introspection and add field-level authorization.

Progress:
1
Run Introspection
2
Extract Sensitive Data
3
Disable Introspection
GraphQL ExplorerIntrospection: ON
POSThttps://api.example.com/graphql
Response
Execute a query to see results...

Challenges

1
Run Introspection
Execute an introspection query to discover the full GraphQL schema.
▼ hints
2
Extract Sensitive Data
Query the users type to extract emails and password hashes.
▼ hints
3
Disable Introspection
Turn off introspection in production and add field-level authorization.
▼ hints
How to fix GraphQL introspection abuse
Disable introspection, add authorization, limit query depth
▼

Frequently Asked Questions