hasura / hasura/graphql-engine
Error message when attempting to access unauthorized parts of the schema can be confusing.
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
Hasura does not leak schema information to unauthorized roles.
This means the error message for attempting to access a field that does not exist,
and for attempting to access a field the current role is not authorized for, are the same:
"cannot find field X"
This makes sense from a security perspective, but it can be confusing and frustrating for new users.
The typical scenario where one may encounter this error involves creating a request in the console graphiql,
and then attempting to run that same, working, valid query, from the user's application.
All of a sudden, the query stops working, and the error message indicates that a field is missing.
"But it isn't! It's right there! I just ran this query!" - screams the user in frustration.
Eventually the users figures it out, but a lot of time could be saved if the error message mentioned the possibility of the field existing, but the role not being authorized to access it. The error message should still not leak information, but give the user a hint to follow once they verify that the field does, in fact, exist.
Something like "cannot find field X. It may not exist, or role may not be authorized."
Contributor guide
Assessment
This issue has not been assessed yet.