50007-1GraphQL Endpoint Supports Introspection

PUBLISHEDsecurity alertInformational
Tool

Metadata

Alert ID:
50007-1
Risk:
Informational
Type:
Tool

摘要

The GraphQL endpoint has Introspection enabled. Introspection allows clients to query the schema and retrieve detailed information about the fields, types, inputs, etc. supported by the GraphQL endpoint. This may be valuable to an attacker, as it could enable them to craft more targeted queries.

解决方案

Disable Introspection on the GraphQL endpoint.

参考