apollographql / apollographql/federation
Disable _service field in Apollo Server for @apollo/subgraph
- Dominant language
- TypeScript
- Stars
- 727
- Forks
- 276
- Avg merge
- 1h 47m
- Merged PRs (30d)
- 1
Description
The `_service` field allows for runtime introspection of the full schema with Federated directives. It is helpful for Rover to fetch the schema if needed. However, if I have a schema file I can use to publish and share the schema the `_service` field is a security risk to potentially over expose the schema information. Just like how we recommend turning off introspection in production we should also have the option to turn off `_service` in production.
This is part an Apollo Server issue as well, but the library that adds the field is here. I will leave it up to the team to decide the best place to accept configuration options
## Option 1
Disable adding the field in the first place
```js
const options = {
disableFederationServiceField: true
};
// New options param
const schema = buildSubgraphSchema({ typeDefs, resolvers, options });
```
## Option 2
Infer from introspection config
```js
const server = new ApolloServer({
typeDefs,
resolvers,
introspection: false // Infer from here to hide the `_service` field ??
});
```
Contributor guide
Research direction
Start at buildSubgraphSchema in the @apollo/subgraph library and trace where the _service field is added. Decide where configuration should be accepted, then verify that the field can be disabled while retaining the current default behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- graphql, typescript
- Domain
- api, backend-api-design, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100