apollographql / apollographql/apollo-server

hideSchemaDetailsFromClientErrors should trap coercion errors arising from query variable bindings

Open
#8,086 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
14k
Forks
2k
Avg merge
5h 30m
Merged PRs (30d)
1

Description

When issuing a query such as `query { noSuchField }`, and passing `hideSchemaDetailsFromClientErrors: true` to the ApolloServer constructor, the Apollo strips "did you mean" suggestions from the error response as expected.

However, when the error arises from a query variable coercion error, the "did you mean" suggestion is **not** stripped from the error message.

This can be worked around using a suitable error formatter, but the docs should at least highlight that the `hideSchemaDetailsFromClientErrors` setting does not apply to this case.

_Example Scenario_

1. Create an ApolloServer with the `hideSchemaDetailsFromClientErrors` setting set to `true`
2. Invoke a query e.g. `query GetUser($filter: UserFilter!) { users(filter: $filter) { id } }`
3. Pass in variables `{ "filter": { "nam": "Bob" } }` where the filter field `nam` is a mispelling of the true field `UseFilter.name`

The returned error message will be of the form

```
"$filter" got invalid value { nam: "Bob" }; Field "nam" is not defined by type "UserFilter". Did you mean "name"?
```

which contains the `Did you mean` schema hint; this is likely because the error is trapped during value coercion, and as a result:

- Apollo’s `validationDidStart()` hook doesn’t get called with these errors
- The internal `ApolloServerPluginDisableSuggestions` plugin never sees the error
- The error passes through unmodified to the client

Contributor guide

Open the contributing guide

Research direction

Start with ApolloServer's hideSchemaDetailsFromClientErrors option and the validationDidStart hook, then trace the variable-coercion path used by the shown GetUser query. Reproduce the UserFilter nam case and compare it with the noSuchField case; done means either coercion errors receive the same suggestion filtering or the documented limitation is explicit.

Written by the indexing model from the issue text.

Assessment

Tech stack
graphql, typescript
Domain
api, backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.