GraphQL security best practices - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Query Depth Limiting

Why is limiting the depth of GraphQL queries important for security?

A To allow users to fetch unlimited data without restrictions

B To prevent attackers from sending deeply nested queries that can overload the server

C To increase the speed of query execution by caching results

D To enable clients to bypass authentication checks

💡 Hint

Think about how complex queries affect server resources.

Limiting query depth helps prevent denial-of-service attacks by stopping very deep nested queries that consume excessive server resources.

❓ query_result

intermediate

Effect of Missing Authorization Checks

Given a GraphQL API without authorization checks on sensitive fields, what is the likely output when an unauthorized user queries those fields?

GraphQL

query {
  user(id: "123") {
    id
    email
    secretData
  }
}

A The query returns an error and no data

B The query returns only id and email, secretData is null

C The query returns only id, email, and a warning message

D The query returns all requested fields including secretData

💡 Hint

Consider what happens if no checks block access.

If authorization is missing, the server will return all requested data, including sensitive fields, exposing secrets to unauthorized users.

📝 Syntax

advanced

Identifying a Syntax Error in a GraphQL Query

Which option contains a syntax error in the GraphQL query?

GraphQL

query {
  user(id: "1") {
    name
    email
  }
}

A

query {
  user(id: "1") {
    name
    email
  }

B

query {
  user(id: 1) {
    name
    email
  }
}

C

query {
  user(id: "1") {
    name
    email
  }
}

D

query {
  user(id: "1") {
    name
    email
  }
  extraField
}

💡 Hint

Look for missing or extra braces.

Option A is missing the closing brace for the query, causing a syntax error.

❓ optimization

advanced

Best Practice to Prevent Introspection Abuse

Which method best helps prevent attackers from abusing GraphQL introspection in production?

A Allow introspection only for authenticated users

B Cache introspection results to speed up queries

C Disable introspection queries in production environments

D Increase query complexity limits

💡 Hint

Think about hiding schema details from attackers.

Disabling introspection in production hides schema details, making it harder for attackers to learn about the API structure.

🔧 Debug

expert

Debugging a Rate Limiting Issue

A GraphQL API implements rate limiting per IP address but some users report they can send unlimited queries. What is the most likely cause?

A Users are behind a shared proxy, so rate limiting applies to the proxy IP, not individual users

B The rate limiting middleware is applied after the query execution

C The API uses query complexity analysis instead of IP-based limits

D The server has no network firewall enabled

💡 Hint

Consider how IP addresses are seen by the server.

If many users share the same IP (like behind a proxy), rate limiting per IP affects all users together, allowing individuals to bypass limits.