Introduction

As GraphQL becomes increasingly common in modern application architectures, ensuring its security is critical. This guide confirms Astra's support for GraphQL API scanning and outlines the broader scanning capabilities available for modern application types.

GraphQL Support

Yes, Astra's vulnerability scanner fully supports GraphQL APIs. The scanner uses advanced techniques that emulate hacker behavior to thoroughly test GraphQL endpoints, identifying and exploiting potential vulnerabilities specific to the GraphQL architecture.

GraphQL scanning is available across all three automated scan modes:

• Lightning Scan

• Full Scan

• Emerging Threats Scan

All three scan modes can also be scheduled via the Automations tab for continuous coverage.

Additional Modern Application Support

Beyond GraphQL, Astra's scanner handles other modern application architectures that traditional scanners often struggle with.

Single Page Applications (SPAs)

Astra's scanner effectively tests SPAs by assessing the communication between frontend and backend, ensuring the overall security of the application including dynamically loaded content and client-side routing.

Areas Behind Login

The scanner actively tests authenticated areas of your application by simulating user interactions including login flows, authentication, and authorization processes. This is particularly important for SaaS applications where most functionality sits behind authentication.

To enable authenticated scanning, configure your login recording under Target Settings. See How to record a login sequence with Chrome DevTools recorder for setup instructions.

Setting Up GraphQL Scanning

1. Add your GraphQL API endpoint as a target in the Astra dashboard

2. Navigate to Targets → Setup Target

3. Select API as the target type

4. Enter your GraphQL endpoint as the Base URL

5. Configure authentication if your GraphQL API requires it

6. Complete the target setup and initiate a scan

For detailed setup instructions see Setting up an API target.

Expected Outcome

Once configured, Astra's scanner will crawl and test your GraphQL API endpoint for vulnerabilities including but not limited to injection attacks, authentication flaws, authorization issues, and exposure of sensitive data through introspection queries.

Troubleshooting

GraphQL endpoint not being scanned despite correct setup

• Confirm the Base URL points directly to your GraphQL endpoint, typically ending in /graphql

• If your GraphQL API requires authentication, ensure credentials are correctly configured under Target Settings → API Auth

• Check that your GraphQL endpoint is not blocking scanner requests via a WAF or rate limiting. See How to scan applications with restricted access for guidance

Scan completes but no GraphQL-specific vulnerabilities are reported

• Ensure you are running a Full Scan rather than a Lightning Scan for comprehensive GraphQL coverage

• Verify that introspection is enabled on your GraphQL endpoint — the scanner uses introspection to map available queries, mutations, and types

Authenticated GraphQL endpoints returning no results

• Review your login recording or API authentication configuration to confirm the scanner is successfully authenticating before sending GraphQL requests

• Check the scan progress page for any login recording errors

SPA frontend not triggering GraphQL calls during scan

• Ensure a login recording is configured so the scanner can access authenticated sections of the SPA where GraphQL calls originate

• Consider uploading a Postman Collection or HAR file to manually populate GraphQL endpoints that are not triggered through standard UI interactions