Access Control: GraphQL Authorization Bypass¶

Identifier: graphql_authz_bypass

Scanner(s) Support¶

GraphQL Scanner	REST Scanner	WebApp Scanner	ASM Scanner

Description¶

GraphQL servers may enforce authorization per operation, but fail to apply the same checks when multiple operations are sent via field aliases or batching in a single HTTP request.

How we test: We introspect the schema, then for each root field without required arguments we replay the operation for each configured user. If a user is denied in a single operation but receives data when the same operation is aliased or batched in one HTTP request, we report an authorization bypass.

References:

https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/12-API_Testing/01-Testing_GraphQL

Configuration¶

Example¶

Example configuration:

---
security_tests:
  graphql_authz_bypass:
    skip: false

Reference¶

`skip`¶

Type : boolean

Skip the test if true.