Payload Verification?
This may seem like a silly question but I am rather new to this lib. Are there any checks that take place to verify that the only files received by the server are those purposefully sent by the client?

I'm imagining a scenario where a MITM could try to add files to the request that do not match what was extracted from the query string.

Absolutely love this application of graphql!