What is GraphQL?
Summary: GraphQL is an API query language that lets clients specify exactly what data they want in a response, avoiding the large response objects and multiple calls sometimes seen with REST APIs. All GraphQL operations use the same endpoint, generally sent as a POST request, and the type and name of the operation define how the query is handled rather than the endpoint or HTTP method.
Key Takeaway: Introspection, a built-in GraphQL function for querying a server about its schema, can expose sensitive information such as field descriptions and help an attacker learn how to interact with the API, which is why PortSwigger states it is best practice to disable introspection in production.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026