Your web application's GraphQL implementation accepts non-JSON queries over POST requests, increasing the risk of Cross-Site Request Forgery (CSRF) attacks. The request was sent with Content-Type application/x-www-form-urlencoded and succeeded.

A successful CSRF attack could result in unauthorized actions being performed on behalf of authenticated users, potentially leading to data manipulation, unauthorized access, or unintended changes to the application state. This can compromise the integrity and security of your web application and may lead to unauthorized disclosure or loss of sensitive information.

Restrict GraphQL queries to JSON-based POST requests to limit the CSRF attack surface.