Direct answer
GraphQL security testing examines what a caller can read or mutate through the schema and how much work a query can cause. A single GraphQL endpoint can expose many distinct permission decisions, so assess resolvers, objects, and fields rather than counting URLs.
Inventory operations and data relationships
Use an owner-provided schema or approved introspection output to identify queries, mutations, and nested object relationships. For a project application, list who may see project metadata, member details, and billing fields before choosing test operations.
- Record the schema version and authenticated role.
- Identify deprecated fields still callable by clients.
- Include mutation operations as well as read queries.
Test resolver and field permissions
Authorization needs to hold when an object is reached directly and through a relationship. With two test users, compare the same known record through each path. Check sensitive field exposure separately from access to the surrounding object.
Reference: OWASP GraphQL Cheat Sheet.
Review query cost controls safely
Depth, list sizes, batching, and repeated operations can increase server work. Agree a small request budget and inspect configured cost limits before sending heavier queries. Observe rejection and worker behavior without trying to exhaust a live service.
- Use small seeded collections and capped pagination.
- Record which limit was enforced and the rejection response.
- Confirm ordinary client queries still complete.
Reference: OWASP GraphQL Cheat Sheet.
Retest the permission path
An error in the GraphQL envelope may coexist with data from other fields. Inspect both data and errors when evaluating a denial. A repair should stop protected fields from being returned while preserving the caller's authorized fields and operations.
Assessment limits
A discovered schema or enabled introspection is not automatically a data access vulnerability. Query complexity tests require availability limits. Missing role fixtures leave resolver authorization incompletely assessed.
Frequently asked questions
Is one GraphQL endpoint one security test?
No. Each operation, object relationship, and sensitive field can enforce a different access rule. Coverage should describe those decisions.
Does disabling introspection fix GraphQL access control?
No. Hiding schema discovery does not establish that resolvers authorize callers. Review permissions even when the schema is supplied privately.
Can a GraphQL error response still expose data?
Yes. Inspect the full response because some fields can succeed while others return errors. The protected data itself determines whether the boundary held.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.