hasura / hasura/graphql-engine

Queries to remote schemas are not transparently forwarded when using input variables

Open
#9,255 2 comments 0 reactions 0 assignees View on GitHub
k/bug t/gql-services
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

This is a follow-up to #8698

### Version Information

Server Version: 2.15.0

### What is the current behaviour?

#### Variable are renamed
When a query using input variables (not scalars) is made against a remote schema, the query is not forwarded as-is, but rewritten, renaming the variables in the process, for example this:
```gql
query MyQuery($filter: TodoFilterInput) {
todos(filter: $filter) {
id
done
task
}
}
```
Becomes this:
```gql
query MyQuery($hasura_json_var_1: TodoFilterInput) {
todos(filter: $hasura_json_var_1) {
id
done
task
}
}
```
### When using prefixes, variables are removed and inlined
The problem is worse when prefixes are used, the variables will be removed and inlined. Given the remote schema prefix `remote_`:
```gql
query MyQuery($filter: remote_TodoFilterInput) {
todos(filter: $filter) {
id
done
task
}
}
```
And the variables:
```json
{
"filter": {
"task": "task filter"
}
}
```
The actual query becomes:
```gql
query MyQuery($hasura_json_var_1: String) {
todos(filter: { task: $hasura_json_var_1}) {
id
done
task
}
}
```
With variables:
```json
{
"hasura_json_var_1": "task filter"
},
```

Both of these are an issue if the user expects requests to be forwarded to the remote schema without changes.
Particularly relevant if the user has, for example, allow-lists in their remote schema.

### What is the expected behaviour?

Hasura should forward requests to remote schemas as-is, without renaming variables or in-lining their values.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.