GraphQL
The schema is the app. Introspection off just means you reconstruct it.
Tags: graphql, idor, api, bfla
Checklist
- Find the endpoint: /graphql, /gql, /api/graphql, persisted queries, batch. OPTIONS and GET vs POST.
- Schema: Introspection, clairvoyance, error suggestions, persisted-query dumps, mobile APK, JS operation names.
- node(id) / global IDs: Replay A IDs as B. Decode Relay IDs. Try the same ID on adjacent types.
- BFLA: Mutations the UI never shows: admin, export, impersonate, invite, billing.
- Aliases and batch: One request, many aliases. Batch HTTP. Rate limits that count requests, not operations.
- Subscriptions: WS handshake auth, channel names, subscribe to another user's node.
- Uploads / nested files: multipart spec, file scalars, SVG/HTML stored then rendered.