hasura / hasura/graphql-engine
Hasura Core: Disabling Query Introspection does not work
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
### Version Information
Server Version:
CLI Version (for CLI related issue):
Latest / Hasura Core [v2.3.1]
### Environment
Core / Running on Docker
### What is the expected behaviour?
Hi there,
Could you please clarify how you are supposed to disable introspection queries on Hasura Core?
There is no where in the Hasura UI/console to disable it.
### Keywords
hasura, core, disable introspection
### What is the current behaviour?
Upon reading the available Hasura Metadata API options at
https://hasura.io/docs/latest/graphql/core/api-reference/metadata-api/introspection.html, sending the following request does not disable introspection for public/guest roles.

### How to reproduce the issue?
1. Send the following json request to your Hasura endpoint at `http://localhost:8080/v1/metadata`
Json Payload
```json
{
"type": "set_graphql_schema_introspection_options",
"args": {
"disabled_for_roles": [
"guest",
"public"
]
}
}
```
With the headers
```
Content-Type: application/json
X-Hasura-Role: admin
x-hasura-admin-secret: {{your admin secret}}
```
3. Hasura responds with a 200 json response.
```json
{
"message": "success"
}
```
4. Export the hasura metadata.
I can see a new file in metadata directory has been created `graphql_schema_introspection.yaml`
with the contents.
```yml
disabled_for_roles:
- guest
- public
```
5. When running an introspection query as a public/guest role, you can still see introspection results.
`http://localhost:8080/v1/graphql`
with the headers
```
Content-Type: application/json
X-Hasura-Role: public
```
graphql payload
```json
{
__schema {
queryType {
fields {
name
description
}
}
}
}
```
responds with
```json
{
"data": {
"__schema": {
"queryType": {
"fields": [
// introspection results
]
}
}
}
}
```
### Screenshots or Screencast

### Please provide any traces or logs that could help here.
When sending an admin request to disable the introspection options
```json
{"type":"http-log","timestamp":"2022-03-24T01:16:53.922+0000","level":"info","detail":{"operation":{"query_execution_time":0.423416126,"user_vars":{"x-hasura-role":"admin"},"request_id":"22872e9b-c2a8-4f02-9375-c4e0d7c4eabb","response_size":21,"query":{"args":{"disabled_for_roles":["guest","public"]},"type":"set_graphql_schema_introspection_options"},"request_mode":"non-graphql","request_read_time":3.833e-6},"request_id":"22872e9b-c2a8-4f02-9375-c4e0d7c4eabb","http_info":{"status":200,"http_version":"HTTP/1.1","url":"/v1/metadata","ip":"192.168.0.1","method":"POST","content_encoding":null}}}
```
Contributor guide
Assessment
This issue has not been assessed yet.