GraphQL abuse: introspection, batching, depth

GraphQL lets the client compose queries. Useful, but it shifts risk: the whole schema can be discovered, and authorization checks must cover every field, not just the endpoint.

The problems

Introspection: __schema reveals all types and operations, mapping the surface. Nested queries: cyclic relations generate huge queries (DoS). Batching: many operations in one request bypass rate limits (e.g. login brute-force). Per-field BOLA: a field returns others' data if the check is missing.

{ __schema { types { name fields { name } } } }   # schema dump

Defence

Disable introspection in production, limit query depth and complexity (depth/cost analysis), rate-limit counting operations not requests, and authorization at the resolver/field level. Persisted queries to accept only known operations.