apollographql / apollographql/federation

Disable _service field in Apollo Server for @apollo/subgraph

Open
#2,991 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
727
Forks
276
Avg merge
1h 47m
Merged PRs (30d)
1

Description

The `_service` field allows for runtime introspection of the full schema with Federated directives. It is helpful for Rover to fetch the schema if needed. However, if I have a schema file I can use to publish and share the schema the `_service` field is a security risk to potentially over expose the schema information. Just like how we recommend turning off introspection in production we should also have the option to turn off `_service` in production.

This is part an Apollo Server issue as well, but the library that adds the field is here. I will leave it up to the team to decide the best place to accept configuration options

## Option 1
Disable adding the field in the first place

```js
const options = {
disableFederationServiceField: true
};

// New options param
const schema = buildSubgraphSchema({ typeDefs, resolvers, options });
```

## Option 2
Infer from introspection config

```js
const server = new ApolloServer({
typeDefs,
resolvers,
introspection: false // Infer from here to hide the `_service` field ??
});
```

Contributor guide

Open the contributing guide

Research direction

Start at buildSubgraphSchema in the @apollo/subgraph library and trace where the _service field is added. Decide where configuration should be accepted, then verify that the field can be disabled while retaining the current default behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
graphql, typescript
Domain
api, backend-api-design, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.