security-review-owasp-graphql

Review GraphQL authorization gaps by inspecting field-level access control, resolver sinks, query complexity, batching, and introspection exposure against OWASP guidance. This produces evidence-based security findings tied to code or configuration without relying solely on top-level route authentication.

Field-level access control in GraphQL security reviews ensures sensitive data exposure is prevented by gating individual fields within schemas, resolvers, mutations, and subscriptions, rather than trusting top-level route authentication to block unauthorized requests.

Prevent expensive GraphQL queries from overloading production by analyzing query depth, complexity limits, pagination, and batching abuse during a security review. This evaluates practical exploitation risk and confirms production configuration enforces query cost limits.

This security review checks GraphQL introspection exposure and error handling. It assesses whether introspection is disabled in production and evaluates error responses to prevent downstream injection risks and sensitive data leakage.

You can assess GraphQL mutations and subscriptions for downstream injection risks. The review evaluates resolver sinks, input validation, and production configuration to identify vulnerable data paths and produce concrete security findings tied to observable behavior.

Reviewing GraphQL schemas without checking resolvers limits abuse-path analysis. You must evaluate resolver sinks, query cost limits, and error handling directly against code and configuration to detect downstream injection risks and confirm sensitive fields are actually gated.