A Flask blog with a login (johndoe/password1) and a GraphQL API at /graphql whose singleUser query returns a user's personal data and API key for any id.
Pas commencéDockercommit 4f50e23x86_64 · aarch64Secret
Query the GraphQL API for other users' private information, including their API keys (insecure direct object reference).
Le brief de ce lab se trouve dans son dépôt.