scan.now
Premium Scan a site

GraphQL schema introspection exposed: What It Means and How to Fix It

An anonymous GraphQL schema-introspection query returned the endpoint schema.

Do this: Disable public production introspection unless clients genuinely require it. The schema gives an attacker a complete map of types, fields and operations to target.
PassNo anonymous schema was returned.
MediumAnonymous schema introspection is enabled.

The fix, in one snippet

Example to adapt Production policy 
allow introspection for authenticated developers; reject anonymous __schema queries

Illustrative values. Change the paths, hostnames and options to match your own site before using it.

The sections below explain what is tested, why it matters and the alternatives.

What we test

Scan.now sends one bounded read-only __schema query to GraphQL endpoints discovered in the page or scripts.

Why it matters

Introspection is useful to developers but gives an unauthenticated attacker a precise inventory of operations, fields and types.

How to fix it

Restrict production introspection to authenticated developer roles when public clients do not require it. Authorization must still be enforced on every resolver.

Where this fits

GraphQL schema introspection exposed is check 8 of 18 that the graphql introspection scanner runs under exposed files and information disclosure, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.

Fix this one first

Above it in the same category sits Exposed server status page (medium), where a server status page (Apache mod_status, nginx stub_status or PHP-FPM status) is reachable from the internet, revealing live requests, client IPs, internal hostnames and load details. An attacker who has that does not need this, so it is the better use of the same hour.

What fixing this still leaves open

GraphQL schema introspection exposed closes one route in. Immediately below it: Stack trace or runtime exception exposed, where the page exposes a stack trace or detailed runtime exception; WordPress user enumeration via REST API, where the WordPress REST API or author archives reveal account usernames to anonymous visitors, giving attackers half of each credential pair before they start guessing passwords; WordPress xmlrpc.php enabled, where the WordPress XML-RPC endpoint at /xmlrpc.php is enabled.

Found in the same scan

The graphql introspection scanner reports this alongside checks from other categories that are at least as serious, including SQL injection, where a GET parameter produced a repeatable database-error or boolean-response SQL injection indicator, and Server-side request forgery, where a URL-like parameter caused the verified server to request a unique Scan.now callback. A single run of graphql introspection scanner answers all of them at once.

Prompt for an AI Hand this check to an assistant Sign in to copy it
The first few lines 
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.

Finding: GraphQL schema introspection exposed (medium severity)
Scanner check id: graphql-introspection-active
17 more lines, including the evidence and the exact fix

The rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.

Sign in with Google

Signing in is free and takes one click. We store your email address and nothing else.

References

  1. OWASP GraphQL Cheat Sheet