hasura / hasura/graphql-engine

Hasura Core: Disabling Query Introspection does not work

Open
#8,348 4 comments 0 reactions 0 assignees View on GitHub
k/question
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

### Version Information

Server Version:
CLI Version (for CLI related issue):

Latest / Hasura Core [v2.3.1]

### Environment

Core / Running on Docker

### What is the expected behaviour?

Hi there,

Could you please clarify how you are supposed to disable introspection queries on Hasura Core?

There is no where in the Hasura UI/console to disable it.

### Keywords
hasura, core, disable introspection

### What is the current behaviour?

Upon reading the available Hasura Metadata API options at
https://hasura.io/docs/latest/graphql/core/api-reference/metadata-api/introspection.html, sending the following request does not disable introspection for public/guest roles.

image

### How to reproduce the issue?

1. Send the following json request to your Hasura endpoint at `http://localhost:8080/v1/metadata`

Json Payload
```json
{
"type": "set_graphql_schema_introspection_options",
"args": {
"disabled_for_roles": [
"guest",
"public"
]
}
}
```

With the headers
```
Content-Type: application/json
X-Hasura-Role: admin
x-hasura-admin-secret: {{your admin secret}}
```

3. Hasura responds with a 200 json response.
```json
{
"message": "success"
}
```

4. Export the hasura metadata.

I can see a new file in metadata directory has been created `graphql_schema_introspection.yaml`

with the contents.

```yml
disabled_for_roles:
- guest
- public

```

5. When running an introspection query as a public/guest role, you can still see introspection results.

`http://localhost:8080/v1/graphql`

with the headers
```
Content-Type: application/json
X-Hasura-Role: public
```

graphql payload
```json
{
__schema {
queryType {
fields {
name
description
}
}
}
}
```

responds with

```json
{
"data": {
"__schema": {
"queryType": {
"fields": [
// introspection results
]
}
}
}
}
```

### Screenshots or Screencast

image

### Please provide any traces or logs that could help here.

When sending an admin request to disable the introspection options

```json
{"type":"http-log","timestamp":"2022-03-24T01:16:53.922+0000","level":"info","detail":{"operation":{"query_execution_time":0.423416126,"user_vars":{"x-hasura-role":"admin"},"request_id":"22872e9b-c2a8-4f02-9375-c4e0d7c4eabb","response_size":21,"query":{"args":{"disabled_for_roles":["guest","public"]},"type":"set_graphql_schema_introspection_options"},"request_mode":"non-graphql","request_read_time":3.833e-6},"request_id":"22872e9b-c2a8-4f02-9375-c4e0d7c4eabb","http_info":{"status":200,"http_version":"HTTP/1.1","url":"/v1/metadata","ip":"192.168.0.1","method":"POST","content_encoding":null}}}
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.