What is GraphQL and How Is It Secured?

GraphQL is a query language and runtime for APIs. Clients describe required fields while a schema defines types, relationships, queries and mutations. One endpoint often replaces many REST routes. This reduces over- and under-fetching but moves security into resolvers, field permissions and limits on freely composed queries.

Example query

query Order($id: ID!) {
  order(id: $id) {
    id
    status
    customer { email }
  }
}

The schema does not automatically prevent users from reading another order or the email field. Enforce object and possibly field authorization in resolvers or central policy.

Unsafe and safer resolver

// Unsafe: every authenticated account can query every ID
order: (_, { id }, ctx) => db.orders.findById(id)

// Better: tenant and permission are part of access
order: async (_, { id }, ctx) => {
  requireAuthenticated(ctx.user);
  return db.orders.findOne({
    id,
    tenantId: ctx.user.tenantId,
    readableBy: ctx.user.id
  });
}

Common GraphQL vulnerabilities

• BOLA/IDOR:
  Resolvers load objects only by client-supplied ID.
• Field authorization:
  Sensitive fields remain reachable through nested paths.
• Denial of service:
  Deep, cyclic, aliased or batched queries amplify work.
• Mass assignment:
  Input objects map directly to data models.
• Disclosure:
  Introspection, errors and suggestions reveal schema and technology.
• Injection:
  Resolver arguments reach databases, templates or operating systems unsafely.

Security baseline

• - Deny by default and enforce object/field authorization centrally.
• - Validate input against schema and business rules; do not bind database models directly.
• - Limit cost by depth, fields, list size and resolver effort.
• - Use pagination, page-size limits, timeouts and identity-based rate limits.
• - Consider persisted queries or allowlists for controlled clients.
• - Decide production introspection by risk; disabling it does not fix authorization.

Useful open-source tools

GraphQL Cop checks common misconfiguration. GraphQLmap supports authorized manual testing and Clairvoyance can infer schema parts from suggestions. Tools cannot validate business logic; use multiple-role test accounts and negative resolver tests.