API Hacking: GraphQL Authorization Consistency
GraphQL feels like one front door, but under the hood it's dozens of resolvers with their own opinions about who can see what. That inconsistency is where authorization bugs live.
Introspection might be off in production, but mobile apps and schema leaks still give you shape. The real work is comparing access across operations, not memorizing field names.
Resolver-level drift
A mutation might enforce ownership while a nested query on another type exposes the same data without checks. Batch loaders and dataloaders make it worse—they cache objects fetched under one user's context.
Subscriptions and live queries are easy to forget in reviews; treat them as first-class.
A sane authorized review flow
Map types to business objects: Order, Patient, Workspace. For each role in scope, ask which operations should exist—not which return errors today.
Run the same logical request as two users and diff field presence
Test list queries with filters removed or widened
Check custom directives and `@auth` gaps on added fields
Reporting and remediation
Document the operation name, variables, and which role crossed a boundary. Recommend central authorization at the resolver or service layer with shared policy tests.
Developers fix faster when you show one field leaking, not a dump of the schema.
GraphQL rewards systematic thinking. Treat it like many small APIs wearing a trench coat.
Authorized testing only—respect rate limits and privacy when comparing accounts.
Schema changes and deprecations
Teams ship new mutations behind feature flags while queries stay permissive—diff schemas over time if you have access to older mobile builds.
Alias batching and nested fragments can trigger resolver paths that bypass middleware expecting REST-style route guards.
Testing with multiple clients
Mobile GraphQL clients sometimes omit fields web clients send—authorization gaps differ by client bundle age.
Persisted queries and allowlists reduce attack surface; verify unlisted operations aren't still reachable.
Ask whether introspection is disabled in all environments or only the obvious prod hostname.
Worth reading next
API Hacking: Broken Object Level Authorization (BOLA)
API Hacking: JWT Pitfalls for Testers and Developers
API Hacking: Swagger and OpenAPI Recon
Comments