idor-graphql-nodes

name	idor-graphql-nodes
description	GraphQL node/edge object-level authorization (BOLA/IDOR): Relay global IDs, nested resolvers, connections, mutations, and field-level leaks. Use when node(id), edges, or ID arguments appear under GraphQL and classic REST IDOR coverage is incomplete. Authorized assessments only.

GraphQL Node / Edge IDOR

Scope And Authorization

• Use only on systems you own, labs, CTFs, or engagements with written scope that includes GraphQL endpoints and test data classes.
• Prefer dual test accounts (User A / User B) plus a cross-tenant or lower-privilege account when allowed. Do not bulk-export foreign PII beyond minimal proof.
• Store schema dumps and HAR captures as sensitive artifacts; redact tokens, cookies, emails, and internal IDs in reports.
• Throttle alias/batch enumeration. Avoid production DoS via deep nested queries unless capacity testing is explicit.
• Destructive mutations (delete, transfer ownership, billing) need an explicit exception in the test plan.

Use When

• Traffic or schema shows node(id:), nodes(ids:), Relay global IDs, or connection/edge patterns (edges { node { ... } }).
• Root queries take id / uuid / slug and nest sensitive fields (user, order, paymentMethod, internalNote).
• Mutations update or delete by ID while the UI only exposes “owned” objects.
• After graphql-and-hidden-parameters maps operations but node/edge authZ is unproven.
• After idor-broken-object-authorization covers REST but GraphQL nested resolvers remain untested.
• Not primary for pure JWT/crypto failures (api-auth-and-jwt-abuse), injection in args (injection-checking), or WebSocket subscriptions auth after upgrade (websocket-authz-deep / websocket-security).

Workflow

1. Inventory ID-bearing surfaces
   From introspection, client operations, or proxy history, list every place an object is selected:

   Surface	Examples
   Root query	user(id:), order(id:), node(id:)
   Batch	nodes(ids:) , aliases a: user(id:"1")
   Connection	viewer { orders(first:) { edges { node { id } } } }
   Nested field	order { customer { email ssn } }
   Mutation	updateOrder(id:, input:), deleteNode(id:)
   Subscription	orderUpdated(id:) (hand long-lived channel auth to WS skills)

   Tag each ID as owned / shared / admin for account A and B. Decode Relay global IDs (base64("TypeName:dbId")) only to understand type confusion risk — ACL still applies per type.

2. Dual-session fixtures
   Capture honest queries as A for A-owned nodes. Hold B’s session (cookie or Bearer) separately. Never mix tokens. Record baseline field sets so over-fetch is measurable.

3. Horizontal node swap (core GraphQL BOLA)
   Replay A’s ID under B’s auth:

   query {
     node(id: "A_RELAY_ID") {
       ... on Order { id total status customer { email } }
     }
     order(id: "A_RAW_ID")  id total 
   
   

Routing

Need	Skill
Classic BOLA methodology, dual-account matrix	idor-broken-object-authorization
Schema recovery, hidden args, batching survey	graphql-and-hidden-parameters
Subscription transport / post-upgrade authZ	websocket-security, websocket-authz-deep
JWT/session broken authN	api-auth-and-jwt-abuse
Implement resolver ACL / deny-by-default	code-quality-standards

Checklist

• Scope and test accounts documented (A/B/tenant)
• ID surface inventory (root, node/nodes, edges, mutations)
• Horizontal swap: B reads A’s node (status + body + errors)
• Nested/edge resolver tests (parent allowed, child foreign)
• nodes(ids:) / alias batch behavior recorded
• Relay/global ID and type-confusion attempts
• Mutation IDOR results or explicit read-only scope
• Field-level leak / error-oracle notes
• Proof pair saved redacted; remediation: per-resolver object ACL