Open robmellett opened 2 years ago
This functionality is available in Hasura Cloud and EE editions only. In open source version, this setting would be ignored.
This is a valid question. Our Testing team have raised this as a security concern. Please suggest a way to disable it on hasura core.
Hasura is an awesome project! And I can understand why the team didn't add this feature in the Hasura CE Open Source.
Just provide two ways:
First, you can enable Hasura Allow Lists.
Second, if you don't want to enable Hasura Allow Lists for more freedom, you can put a reverse proxy such as Traefik in the front and use Disable GraphQL Introspection plugin I created. 😃
if you use Nginx
as a reverse proxy and want to disable GraphQL Introspection, you can use the Nginx js module
and validate the request body: nginx-disable-graphql-introspection
Version Information
Server Version: CLI Version (for CLI related issue):
Latest / Hasura Core [v2.3.1]
Environment
Core / Running on Docker
What is the expected behaviour?
Hi there,
Could you please clarify how you are supposed to disable introspection queries on Hasura Core?
There is no where in the Hasura UI/console to disable it.
Keywords
hasura, core, disable introspection
What is the current behaviour?
Upon reading the available Hasura Metadata API options at https://hasura.io/docs/latest/graphql/core/api-reference/metadata-api/introspection.html, sending the following request does not disable introspection for public/guest roles.
How to reproduce the issue?
http://localhost:8080/v1/metadata
Json Payload
With the headers
Hasura responds with a 200 json response.
Export the hasura metadata.
I can see a new file in metadata directory has been created
graphql_schema_introspection.yaml
with the contents.
http://localhost:8080/v1/graphql
with the headers
graphql payload
responds with
Screenshots or Screencast
Please provide any traces or logs that could help here.
When sending an admin request to disable the introspection options