GraphQL Introspection & Batching Abuse

Definition

GraphQL lets a client describe exactly what it wants. That is the feature. It also means the server must enforce authorization and resource limits per field and per resolver, rather than per endpoint.

Two distinct problems

Schema disclosure

Introspection describes the entire graph: types, fields, mutations, arguments. Where it is open to unauthenticated callers, it removes most of the discovery work and names the privileged operations directly.

Batching and volume

Batched or deeply nested queries let one request do a great deal of work. Without depth, complexity and rate controls, that becomes both a resource problem and a way to iterate through data faster than per-request monitoring expects.

Neither issue is inherently a breach. Both change what an attacker can find and how quickly.