GraphQL Security — Introspection and Depth Limiting

GraphQL gives clients enormous flexibility: a single endpoint where the client specifies exactly which fields and relationships it wants. That flexibility is powerful for developers but shifts control toward the client, creating security concerns REST does not share. A client can request deeply nested data, discover the entire schema, or craft queries so expensive they overwhelm the server, all through the normal query mechanism.

Analogy🏏Cricket

🍳 Think of it like cooking: A recipe can look flawless on paper, but a head chef only truly judges the dish by tasting the finished plate, because heat, timing, and the actual oven reveal problems the written method never shows. Just as tasting the cooked result catches what reading the recipe cannot, DAST probes the running application and catches the misconfigurations and runtime behaviour that reading the source cannot. This reveals DAST's stance: it judges the dish as it is actually served, not the recipe as it was merely written.

This lesson covers the GraphQL-specific risks, introspection exposing the schema, unbounded query depth and complexity enabling denial of service, and the subtle point that authorization must be enforced per field and resolver, not per endpoint. The underlying theme is that GraphQL's client-driven model requires the server to reassert control over what, how deeply, and how expensively clients may query.

Analogy🏏Cricket

💰 Think of it like finance: A real audit that actually attempts a sample transaction proves beyond doubt whether a control can be bypassed, with little room for a false alarm, but it can only test the accounts and processes the auditors actually reach. Just as a hands-on audit yields high-confidence, low-false-positive results yet is bounded by what it examines, DAST yields high-confidence findings about real exploitability yet is bounded by the surface it can reach. This reveals its trade-off: what it confirms is solid, but it only confirms what it manages to touch.