apollographql / apollographql/apollo-server
hideSchemaDetailsFromClientErrors should trap coercion errors arising from query variable bindings
- Dominant language
- TypeScript
- Stars
- 14k
- Forks
- 2k
- Avg merge
- 5h 30m
- Merged PRs (30d)
- 1
Description
When issuing a query such as `query { noSuchField }`, and passing `hideSchemaDetailsFromClientErrors: true` to the ApolloServer constructor, the Apollo strips "did you mean" suggestions from the error response as expected.
However, when the error arises from a query variable coercion error, the "did you mean" suggestion is **not** stripped from the error message.
This can be worked around using a suitable error formatter, but the docs should at least highlight that the `hideSchemaDetailsFromClientErrors` setting does not apply to this case.
_Example Scenario_
1. Create an ApolloServer with the `hideSchemaDetailsFromClientErrors` setting set to `true`
2. Invoke a query e.g. `query GetUser($filter: UserFilter!) { users(filter: $filter) { id } }`
3. Pass in variables `{ "filter": { "nam": "Bob" } }` where the filter field `nam` is a mispelling of the true field `UseFilter.name`
The returned error message will be of the form
```
"$filter" got invalid value { nam: "Bob" }; Field "nam" is not defined by type "UserFilter". Did you mean "name"?
```
which contains the `Did you mean` schema hint; this is likely because the error is trapped during value coercion, and as a result:
- Apollo’s `validationDidStart()` hook doesn’t get called with these errors
- The internal `ApolloServerPluginDisableSuggestions` plugin never sees the error
- The error passes through unmodified to the client
Contributor guide
Research direction
Start with ApolloServer's hideSchemaDetailsFromClientErrors option and the validationDidStart hook, then trace the variable-coercion path used by the shown GetUser query. Reproduce the UserFilter nam case and compare it with the noSuchField case; done means either coercion errors receive the same suggestion filtering or the documented limitation is explicit.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- graphql, typescript
- Domain
- api, backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100