Your web application's GraphQL implementation accepts non-JSON queries over GET requests, increasing the risk of Cross-Site Request Forgery (CSRF) attacks. While JSON-based POST requests are generally considered resistant to CSRF, non-JSON GET requests are more susceptible to this type of attacks.

A successful CSRF attack could result in unauthorized actions being performed on behalf of authenticated users, potentially leading to data manipulation, unauthorized access, or unintended changes to the application state. This can compromise the integrity and security of your web application and may lead to unauthorized disclosure or loss of sensitive information.

Restrict GraphQL queries to JSON-based POST requests to limit the CSRF attack surface.