The "graphql-upload" (https://www.npmjs.com/package/graphql-upload) npm package can execute GraphQL operations contained in "content-type: multipart/form-data" POST requests. Because they are POST requests, they can contain GraphQL mutations. Because they use "content-type: multipart/form-data", they can be "simple requests" which are not preflighted by browsers. If your GraphQL server uses "graphql-upload" and uses "SameSite=None" cookies for authentication, then JS on any origin can cause browsers to send cookie-authenticated mutations to your GraphQL server, which will be executed without checking your CORS policy first. (The attack won't be able to see the response to the mutation if your CORS policy is set up properly, but the side effects of the mutation will still happen.) Additionally, if your GraphQL server uses "graphql-upload" and relies on network properties for security (whether by explicitly looking at the client's IP address or by only being available on a private network), then JS on any origin can cause browsers (which may be on a private network or have an allowed IP address) to send mutations to your GraphQL server, which will be executed without checking your CORS policy first. (This attack does not require your server to use cookies. It is in some cases prevented by some browsers such as Chrome.) Apollo Server 2 bundled "graphql-upload" and enabled it by default, so by default, Apollo Server 2 servers are vulnerable to these CSRF attacks. (Apollo Server 1 did not bundle "graphql-upload". Apollo Server 3 no longer bundles "graphql-upload", although AS3's docs do document how to manually integrate with "graphql-upload".) It is enabled even if your server makes no use of the upload functionality. If you are running Apollo Server 2 (older than v2.25.4) and do not specify "uploads: false" to "new ApolloServer", then you are vulnerable to this CSRF mutation attack. We recently introduced an opt-in CSRF prevention feature in Apollo Server 3.7. This feature successfully protects against CSRF even if you have manually integrated your AS3.7 server with "graphql-upload". However, this feature is not available for Apollo Server 2.