domains / families / security / performing-graphql-security-assessment

performing-graphql-security-assessment

separate

Assessing GraphQL API endpoints for introspection leaks, injection attacks,

When to use

• During authorized penetration tests when the target application uses a GraphQL API
• When assessing single-page applications (React, Vue, Angular) that communicate via GraphQL
• For evaluating mobile app backends that expose GraphQL endpoints
• When testing microservice architectures with a GraphQL gateway or federation
• During bug bounty programs targeting GraphQL-based APIs

Skill page

Source