graphql-idor

To test GraphQL endpoints for IDOR and authorization bypasses, POST operations in unauthenticated and authenticated contexts to check introspection, query scoping, mutation ownership, and batch enumeration for unauthorized data leaks.

GraphQL IDOR is an authorization failure where client-controlled arguments like userId or resource IDs allow users to access or mutate data they don't own. It enables horizontal privilege escalation when servers fail to enforce ownership checks on queries and mutations.

Yes, you can check for unauthenticated GraphQL mutations and batch enumeration vulnerabilities by POSTing operations without authorization headers and running single queries to determine if data leaks across multiple users in a single request.

GraphQL introspection probing helps learn available schema and operations, enabling you to map queries and mutations for testing authorization boundaries, client-controlled ID arguments, and unauthenticated mutation attempts.

To start testing GraphQL authorization boundaries, you need an in-scope /graphql endpoint or recon target directory, plus any required Authorization Bearer header so the testing workflow can compare unauthenticated, baseline authorized, and cross-user access behavior.

You should not rely on GraphQL IDOR testing when actual unauthorized data is not returned during operations; findings are only confirmed when real unauthorized data is accessed via queries or mutations with missing server-side ownership constraints.