GraphQL node(id) / alias batch

Tags: graphql, idor, api, bfla

Typical severity: P2-P3

What it becomes

Relay-style node(id) and aliased batch queries skip the UI's object graph. Same as IDOR, with a nicer query language.

Where to look

• node(id:)

  Copy

• viewer vs user(id:)

  Copy

• aliased queries

  Copy

• batch JSON arrays

  Copy

• subscriptions

  Copy

Chains

• IDOR / BOLA: Swap a global ID from account A into a query as account B. Export and search fields are the usual amplifiers.
• BFLA: Admin mutations still in the schema. The UI hid the button; the schema did not.
• Rate-limit skip: One HTTP request, hundreds of aliases. Lockout and billing counters that key on request count lose.

Notes

• clairvoyance and field suggestions reconstruct the schema without introspection.
• Subscriptions are WebSockets. Auth on the handshake is the whole game.