A Flask blog with a login (johndoe/password1) and a GraphQL API at /graphql whose singleUser query returns a user's personal data and API key for any id.
Not startedDockercommit 4f50e23x86_64 · aarch64Secret
Query the GraphQL API for other users' private information, including their API keys (insecure direct object reference).
The brief for this lab lives in its repository.