GraphQL Mental Model
One endpoint, many fields — authz per field still required. Lab :8817.
Visual · api_graphql_model
GraphQL is a query language over HTTP. Original Cyberlium.
Clients ask for fields. Servers must still authorize each one.
GraphQL consolidates routes into queries/mutations. Flexibility is not a free pass past authz. Practice on YOUR lab GraphQL — not scraping public graphs without permission.
1. Query and mutation
Queries read. Mutations change. Subscriptions stream — advanced.
POST /graphql with a JSON body is common.
Command guide
Try these commands — Query and mutation
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
GraphQL overview — https://graphql.org/learn/ (schema literacy) OWASP GraphQL — https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install jq
macOS:
Command — copy this
brew install jq
Windows: Built-in (PowerShell: Invoke-WebRequest)
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
curl -sS -X POST http://127.0.0.1:8817/graphql -H "Content-Type: application/json" -d '{"query":"{ __typename }"}' | jq .
curl -sS -X POST http://127.0.0.1:8817/graphql -H "Content-Type: application/json" -d '{"query":"query { items { id name } }"}' | jq '.data // .errors'Primary tools to practice this lesson: curl, jq. Reference sites: GraphQL overview (https://graphql.org/learn/); OWASP GraphQL (https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Authz still exists
Field-level authorization matters. Nested objects can leak.
BOLA shapes appear inside GraphQL selections too.
3. Lab hello
Send { __typename } to YOUR lab.
Do not hammer public GraphQL endpoints as homework.
4. What you ship: GraphQL basics
Query vs mutation. Authz still required. Lab hello.
5. What you record before the next lesson
Hello response from :8817.
6. Wrong vs right: stranger APIs vs literacy on systems you own
Worked failure — same API word, opposite target. Right never needs a live shop or classmate token.
- Wrong: Introspect random production graphs without authorization.
- Right: Lab hello. Next: introspection.
Mission: GraphQL hello
1) POST { __typename }. 2) Write query vs mutation. 3) Note authz still required.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “GraphQL vs REST in one sentence?”
APPLY: Mutations:
APPLY: True or False: GraphQL removes need for authz.
APPLY: Common path:
Introspection Risks
Part of API Security with AI — GraphQL Risks.
Batching and Field Authz
Part of API Security with AI — GraphQL Risks.
GraphQL Lab — Introspect and Policy
Part of API Security with AI — GraphQL Risks.