Security Test: Introspection enabled¶

Description¶

Default Severity: info

Enabling introspection in a GraphQL API means that anyone can ask the server for detailed information about its structure, which can give attackers a clear picture of potential weak spots. This can lead to risks like exposing hidden fields, types, and operations that may not be documented or intended for public use. If developers forget to disable introspection in production, it can make the system easier to exploit, potentially allowing attackers to craft queries that reveal or manipulate sensitive data.

Reference:

• https://www.apollographql.com/blog/graphql/security/why-you-should-disable-graphql-introspection-in-production/

Configuration¶

Identifier: information_disclosure/introspection_enabled

Examples¶

All configuration available:

checks:
  information_disclosure/introspection_enabled:
    skip: false # default

Compliance and Standards¶