Enabling/Disabling schema introspection

[dilip9292]

Hi Team we are currently looking for a way to disable introspection in bramble application. We want users to prevent from doing the following queries

{
  __schema {
    types {
      name
      kind
    }
  }
}

Something similar to disable introspection in gql-gen https://github.com/99designs/gqlgen/blob/7435403cf94ce8147fdd9d473a5469d63e7e5b38/graphql/context_operation.go#L20

Can one help me on how can we achieve this using bramble

[anar-khalilov]

Yes, this is a very much needed feature.

[anar-khalilov]

Could you please look into this issue, we are having hard time.

[pkqk]

Hi @dilip9292 and @anar-khalilov there isn't currently a way to switch this option on, bramble uses the graph-gophers library instead of gqlgen which has a similar option to disable introspection.

You could patch the ExecuteQuery function in executable_schema.go to set disableIntrospection to false on the filteredSchema value before its passed into newQueryExecution.

[anar-khalilov]

Hi @pkqk, I see a PR has been approved. 👍 I was wondering when the merge will happen to decide to include our task in current sprint or the next one to use this feature.

[pkqk]

hi @anar-khalilov I've just published a new release with the changes by @mai00cmi in. I also updated the docker-compose file so you can verify it works.

If you add:

{
+ "disable-introspection": false,
  "services": [
    "http://gqlgen-server:8080/query",
    "http://gophers-server:8080/query",
    "http://nodejs-server:8080/query"
  ]
}

to the config in examples/example-config.json and run:

docker compose up

You can test this works by making a query to http://localhost:8082/query, eg:

query {
  __type(name: "Foo") {
    name
  }
  __schema {
    types {
      name
    }
  }
}

returns:

{
  "data": {
    "__type": null,
    "__schema": null
  }
}

[anar-khalilov]

Thanks a lot. Will try it asap.