API › Module 8 › Lesson 4
GraphQL Lab — Introspect and Policy
Hello + introspection on :8817; write prod policy and limits.
Visual · api_graphql_lab
Lab: local GraphQL literacy pack. Original Cyberlium.
Opening
Map your own schema — not the internet's.
Run hello and introspection on YOUR lab. Write disable/restrict + depth/batch notes.
1. Hello + introspect
__typename and __schema on lab.
Save redacted output.
Command guide
Try these commands — Hello + introspect
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
GraphQL security — https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html Secret scanning — https://github.com/gitleaks/gitleaks
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install jq
macOS:
Command — copy this
brew install jq
Windows: Built-in (PowerShell: Invoke-WebRequest)
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
curl -sS -X POST http://127.0.0.1:8817/graphql -H "Content-Type: application/json" -d '{"query":"mutation { updateItem(id:1, name:"lab") { id } }"}' | jq .
grep -rEn 'password|secret|token' "$HOME/cyberlium-lab/t13-api" --include='*.env*' --include='*.json' 2>/dev/null | head -5 || echo 'Scan YOUR lab config files for accidental secrets'Primary tools to practice this lesson: curl, jq, grep. Reference sites: GraphQL security (https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html); Secret scanning (https://github.com/gitleaks/gitleaks). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Policy
Prod: disable/restrict introspection.
Add depth/complexity note.
3. Ethics
No stranger graphs.
No DoS practice on public demos.
4. What you ship: GraphQL lab pack
Transcript + policy + limits.
5. What you record before the next lesson
Port 8817 notes.
6. Wrong vs right: stranger APIs vs literacy on systems you own
Worked failure — same API word, opposite target. Right never needs a live shop or classmate token.
Wrong
Publish introspection results from a private company graph.
Right
Lab pack. Next: quiz.
Mission: GraphQL lab
1) Hello. 2) Introspect lab. 3) Write prod policy + limits.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Sample introspection query?”
Knowledge Check
APPLY: Lab target:
Multiple choice
Knowledge Check
APPLY: True or False: DoS public GraphQL for credit.
True or False
Knowledge Check
APPLY: Pack includes:
Multiple choice