Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add back basic functionality (headers) #84

Closed
3 tasks
execveat opened this issue Feb 1, 2023 · 1 comment
Closed
3 tasks

Add back basic functionality (headers) #84

execveat opened this issue Feb 1, 2023 · 1 comment
Assignees
Labels
Enhancement New feature or request
Milestone

Comments

@execveat
Copy link
Collaborator

execveat commented Feb 1, 2023

It should be possible to do the following:

  • open a new Burp session, go to InQL tab and enter address of such GraphQL API that requires auth headers in order to produce introspection results (either detect that query has failed due to missing headers and prompt user to add them or simply display the default headers before sending the introspection query so that user can add whatever they need)
  • once the introspection schema has been parsed, all actions on individual queries/mutations (e.g. "Send to Repeater") should generate queries with the same headers that were used to send introspection query. It's ok to provide a way for user to update headers manually, but apart from this corner case it is expected that if InQL was able to generate sample queries, these queries will work as-is (with the same permissions that were used during introspection). The only action that might be reasonable required from the user is to fill in input variables as there is no way for InQL to understand their semantics
  • the same expectations apply to GraphiQL, so if auth headers are provided during introspection request - a user should get fully functional GraphiQL after using "Send to GraphiQL" menu option. Meaning GraphiQL should inherit all headers from InQL
@execveat execveat added the Enhancement New feature or request label Feb 1, 2023
@execveat execveat added this to the v5.0 milestone Feb 1, 2023
@execveat execveat assigned execveat and unassigned execveat Mar 29, 2023
@execveat execveat linked a pull request Mar 29, 2023 that will close this issue
@execveat
Copy link
Collaborator Author

GraphiQL is being postponed until the next release, the rest has been implemented.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Enhancement New feature or request
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants