wstg-api-testing

Start with introspection to map the schema, then test authorization on every resolver with different user contexts, inject SQL and XSS payloads into arguments, and attempt deep nested queries and batched operations. Follow the OWASP WSTG-APIT-01 methodology for systematic coverage.

Extract all queries and mutations from the schema, then replay them with different authentication contexts: unauthenticated, low-privilege, and another user's token. Substitute other users' IDs in arguments to detect broken object-level authorization, since GraphQL itself enforces no access control.

GraphQL accepts multiple operations in a single HTTP request as a JSON array or via aliases. Since WAFs and rate limiters typically count HTTP requests, one batched request can carry hundreds of brute-force attempts against authentication or token endpoints undetected.

Yes. Even with introspection disabled, GraphQL error messages often leak type names, field names, and expected argument types. An attacker can incrementally reconstruct the schema from these error fragments, so generic error responses are also required.

Enforce maximum query depth, assign complexity scores to fields and reject queries exceeding a cost threshold, apply query timeouts, and require pagination limits on list fields. Circular type relationships make unbounded recursion possible without these controls.