Is it possible to disable GraphQL introspection on production?

svn__last year

5

• 

  zsazsagabonklast year

  Hi! Set

  graphQL: {disable: true}

  in your payload.config.ts file to totally disable graphQL

  
  
  https://payloadcms.com/docs/graphql/overview
• 

  svn__last year

  Hmm, but as far as I understood it disables GraphQL completly. I still want to use it, just don’t want to make it accessible without authorization. My only idea for now was to use the Express middleware but maybe there is an easier way?

  
  
  

  I secured it with express.postMiddleware, I'm not sure if this is the best approach, but it seems to work well:

  
  
  

  export const secureGraphQLIntrospection = (req: PayloadRequest, res: Response, next: NextFunction) => {
    const isGqlPath = req.path === '/graphql';
  
    if (isGqlPath) {
      const query = isObject(req.body) ? req.body.query : null;
      const isIntrospectionQuery = typeof query === 'string' && query.includes('__schema');
      if (isIntrospectionQuery && !req.user) {
        return res.status(403).json({ error: 'Introspection queries are not allowed' });
      }
    }
  
    next();
  };

• 

  tlmader2 weeks ago

  @545926768327131137

  have you found a better solution for this?

• 

  svn__2 weeks ago

  Hey, unfortunately not :/ This comment might be helpful to decide if it's worth implementing:

  https://github.com/payloadcms/payload/discussions/4571#discussioncomment-7908645
• 

  tlmader2 weeks ago

  I'm going to give this a try:

  https://www.npmjs.com/package/graphql-disable-introspection
  

  thanks!