ChilliCream / ChilliCream/graphql-platform

AllowIntrospection validation from SchemaBuilder

Open
#6,967 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

🌶️ hot chocolate Area: Security
Dominant language
C#
Stars
5.8k
Forks
810
Avg merge
15h 39m
Merged PRs (30d)
98

Description

Product

Hot Chocolate

Is your feature request related to a problem?

Im trying to use the Schema first logic of hotchocolate in my graphql application. I have a schemaBuilder that builds the graphql schema using a json. Post this I want to be able to disable introspection on the schema but I have no graphql server setup. My code looks like the follows:
` ISchema schema = schemaBuilder.Create();

        IRequestExecutor requestExecutable = schema.MakeExecutable();

        // if no executable options then query endpoint without passing them in.
        IExecutionResult result = variableValues == null ? requestExecutable.Execute(query) : requestExecutable.Execute(query, variableValues);`

In the above, how do i set this property to false, I dont see any option to disable introspection.

The solution you'd like

Solution that would help would be something like, schemaBuilder.ModifyOptions(o => o.AllowIntrospection = false);

Please do let me know if there are any other workarounds that I can use?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing how SchemaBuilder.Create() produces an ISchema and how schema.MakeExecutable() configures the IRequestExecutor. Locate the execution options used for introspection and determine whether SchemaBuilder can expose them. Done means callers can disable introspection before executing queries without setting up a GraphQL server.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
api, backend
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.