GraphQL schema discovery, batching, and resolver authorization

Mechanism

GraphQL exposes typed operations whose fields are resolved by application code. Security checks must apply to object and field access, not only the outer HTTP route. Schema discovery can reveal attack surface but is not inherently a vulnerability. Aliases and batching can multiply work or bypass limits applied only per request.

Practical method

Identify the endpoint, supported transport, and authentication state. Inspect permitted schema information and construct a minimal query for a known fixture. Compare access to the same object through different resolver paths. Test aliases and nesting with bounded sizes and observe whether limits count operations, fields, or requests.

query {
  first: item(id: "fixture-a") { id name }
  second: item(id: "fixture-b") { id name }
}

Interpreting evidence

Demonstrate an unauthorized field or object response, not merely a visible schema. Record which resolver bypasses a check present on another route.

Pitfalls and limits

Errors may contain partial data. HTTP status 200 does not mean every field succeeded. Depth limits alone do not constrain expensive breadth, and a disabled introspection endpoint can still leave predictable fields reachable.