Issue name

GraphQL suggestions enabled

Typical severity

Low

Issue description

GraphQL suggestions are an Apollo feature in which the server is configured to respond to invalid queries with suggestions for valid queries that have a similar syntax.

Suggestions can represent a significant security risk, as they enable attackers to glean information about a GraphQL schema even if introspection is disabled. By sending intentionally invalid queries and collating suggestions in responses, attackers can learn the names and structures of valid queries and mutations.

Issue remediation

Ensure that you have disabled or otherwise masked error messages containing suggestions on your GraphQL server.

References

Vulnerability classifications

Web intro