All 15 GraphQL questions
More in GraphQL
What is GraphQL, and how does it differ from a traditional REST API in terms of how clients request data? What is the difference between a GraphQL query variable and hardcoding a value directly inside the query string? How would you set up a basic GraphQL server in Node.js using Apollo Server, defining a schema and resolvers? What is the difference between a GraphQL Query, Mutation, and Subscription operation type? What is the purpose of GraphQL fragments, and how do they help avoid duplicating field selections across multiple queries? How would you handle file uploads in a GraphQL API, given GraphQL's standard JSON-based transport doesn't naturally support binary file data? What is the purpose of GraphQL's non-null (!) type modifier, and what happens if a resolver for a non-null field returns null unexpectedly? What is the difference between a GraphQL scalar type and an object type, and how would you define a custom scalar (like DateTime) in a Node.js GraphQL server? What is the N+1 query problem in GraphQL specifically, and how does DataLoader solve it? How would you implement authentication and authorization in a GraphQL API in Node.js, given there's typically only a single HTTP endpoint?
Advertisement
Back to results for “RESTful API Design with Express”
Node.js › GraphQL

What is GraphQL introspection, and why might you want to disable it in a production environment?

Intermediate

Answer

Introspection lets a client query the GraphQL schema itself (available types, fields, and their descriptions), which is what powers developer tools like GraphiQL/Apollo Sandbox for auto-generating documentation and enabling autocomplete -- while extremely useful during development, exposing the full schema in production can reveal internal implementation details (field names hinting at unreleased features, or the overall data model) to anyone who queries it, which is why many teams disable introspection (and the associated playground UI) specifically in production.
const server = new ApolloServer({
  typeDefs,
  resolvers,
  introspection: process.env.NODE_ENV !== 'production', // disabled in production
});
Real-world example A company discovers a competitor was able to infer an unreleased feature simply by querying their production GraphQL API's introspection endpoint and noticing new, not-yet-documented fields in the schema, prompting them to disable introspection in production going forward.

Common follow-ups: What's the tradeoff of disabling introspection in production if your own frontend team still needs schema information for their own tooling?;Are there ways to expose introspection securely, like only to authenticated internal users?

Security;RESTful API Design with Express
All 15 GraphQL questions