Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add property for disabling GraphQL schema introspection

Browse Source 
Prior to this commit, the GraphQL schema assembled by the
auto-configuration would provide no option for disabling the field
introspection.

While this feature is essential for many tools (including GraphiQL),
some prefer disabling it because this allows clients to gather
information about types and schema easily. This commit introduces a new
`spring.graphql.schema.introspection.enabled` configuration property.

Because potential attackers can still gather this information and this
feature is a core concern in the GraphQL spec, introspection is enabled
by default for Spring Boot applications.

Closes gh-29248
This commit is contained in:
Brian Clozel
2022-01-03 17:09:40 +01:00
parent 728206dba0
commit c5817f21eb
4 changed files with 51 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
spring-boot-project/spring-boot-docs/src/docs/asciidoc/web/spring-graphql.adoc
View File

@@ -40,6 +40,8 @@ In the following sections, we'll consider this sample GraphQL schema, defining t
include::{docs-resources}/graphql/schema.graphqls[]
----
NOTE: By default, https://spec.graphql.org/draft/#sec-Introspection[field introspection] will be allowed on the schema as it is required for tools such as GraphiQL.
If you wish to not expose information about the schema, you can disable introspection by setting configprop:spring.graphql.schema.introspection.enabled[] to `false`.
[[web.graphql.runtimewiring]]
=== GraphQL RuntimeWiring