OWASP GraphQL Cheat Sheet

1. Common Attacks

   Injection, DoS, introspection abuse and batching attacks.

2. Input Validation

   Schema types, allow-listing and validating arguments.

3. DoS Prevention

   Query depth, amount and cost limits and timeouts.

4. Access Control

   Authorization at resolver and field level.

5. Batching Attacks

   Aliases and array batching abuse.

6. Secure Configurations

   Disabling introspection and debug in production.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.