awesome-graphql-security

A curated list of awesome GraphQL Security frameworks, libraries, software and resources

397

GitHub Stars

Curated Resources

Use this list with your AI agent

Add the Context Awesome MCP server to Claude, Cursor, or any MCP client, then ask:

"Show me blogs resources from awesome-graphql-security"

Access Control Best Practices for GraphQL with Authentication and AuthorizationBlogs
Confusion between authentication and authorization causes data leaks. Learn the difference and how to implement the right access control pattern in your GraphQL API.
Apollo BlogBlogs
Take your GraphQL skills to the next level with our free interactive GraphQL tutorials, videos, quizzes and code challenges.
GraphQL for PentestersBlogs
Introduction to Basic Concepts, Security Considerations & Reconnaissance, Vulnerabilities and Attacks, Offensive Tools.
GraphQL security for decentralized applications (DApps): challenges and best practicesBlogs
Learn about GraphQL security, performance, testing and building production-ready APIs with the latest tools and best practices of the GraphQL ecosystem.
Implementing GraphQL Authorization: A Practical GuideBlogs
Learn how to implement scalable authorization in GraphQL. Simplify RBAC and Permissions management with step-by-step instructions.
The GraphQL Security BlogBlogs
Learn about GraphQL security, performance, testing and building production-ready APIs with the latest tools and best practices of the GraphQL ecosystem.

Aliasing AttacksVulnerabilities
Addressing the Security concerns of GraphQL Aliases.
Enhancing GraphQL Security by Detecting Malicious Queries Using Large Language Models, Sentence Transformers, and Convolutional Neural Networks
File Inclusion and Directory TraversalVulnerabilities
Reading arbitrary server files through unvalidated path parameters in GraphQL.
GraphQL CSRFVulnerabilities
Understanding and Dealing with Cross-Site Request Forgery Attacks (CSRF) in GraphQL.
GraphQL Cyclic Queries and Depth LimitingVulnerabilities
The relational aspect of GraphQL can be a vulnerability exploited by running deep and cyclic queries causing your API to crawl under the load and crash.
HTTPS and GraphQLVulnerabilities
How HTTPS can prevent Data Leaks.

AltairClients and IDEs
GraphQL Client helps you debug GraphQL queries and implementations. Also distributed as a Browser Extension.
CraftQLVisualizers
CLI GraphQL schema viewer, view schema diagram on the terminal or generate graphviz .dot format file
GraphManSelf-Discovery
Generate a complete Postman collection from a GraphQL endpoint. Allows instant and easy discovery and exploration of the API.
GraphQL InspectorVisualizers
GraphQL RoverVisualizers
GraphQL schema viewer for endpoints with introspection
HoppscotchClients and IDEs
Online REST and GraphQL client

BatchQLExploitation
GraphQL security auditing script with a focus on performing batch GraphQL queries and mutations.
ClairvoyanceDiscovery
Patrial introspection fetcher when introspection is disabled.
CrackQLExploitation
GraphQL password brute-force and fuzzing utility.
Damn Vulnerable GraphQL ApplicationVulnerable Applications
An intentionally vulnerable implementation of Facebook's GraphQL technology, to learn and practice GraphQL Security.
GoctopusDiscovery
a GraphQL endpoint discovery and fingerprinting tool.
GraphCrawlerExploitation
A GraphQL automated security toolkit. Grab introspection, search for sensitive queries, and then test authorization.

Escape - GraphQL SecurityContinous Security Testing
Continuous GraphQL Security Testing for Developers. Find and fix GraphQL security flaws in the CI/CD.
GraphQL ArmorMiddlewares
Highly customizable security middleware for Apollo GraphQL and Envelop servers.
GraphQL AuthzAuthentication & Authorization
GraphQL authorization layer
GraphQL CopContinous Security Testing
Utility to run common security tests against GraphQL APIs that can be run inside CI/CD.
WAF for GraphQLSecurity Solutions
Web Application Firewall for GraphQL APIs.

Showing a sample of 44 resources. View the full list on GitHub →