API Testing · Senior · Question 44 of 75

How do you test GraphQL authorization properly?

1Only on the single /graphql endpoint URL
2Only on mutations, since queries just read data
3Per field and per resolver, including nested paths

Show the answer

Correct answer: Per field and per resolver, including nested paths

Explanation

A user may be blocked from user(id) but reach the same data via order { customer { email } }. Every path needs checks.

Further reading

Test yourself

Take the API Testing · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.