Security Test: GraphQL Extension Disclosure¶

Description¶

Default Severity: medium

GraphQL Extension Disclosure happens when a GraphQL server unintentionally gives away too many internal details through its custom extensions. If sensitive information like your server’s schema or the inner workings of its resolvers is exposed, attackers can use it to tailor attacks more precisely against your system. This typically happens when extra debugging or monitoring features are left enabled in a production environment, making it easier for someone with malicious intent to learn how your server is built and where its vulnerabilities lie. Always be cautious about what extra data your server sends out—keep any sensitive configuration details under wraps to reduce the risk of an attack.

Configuration¶

Identifier: configuration/graphql_extension_disclosure

Examples¶

All configuration available:

checks:
  configuration/graphql_extension_disclosure:
    skip: false # default

Compliance and Standards¶