parse-community / parse-community/parse-server
Add graphql disableIntrospection or masterKeyOnlyIntrospection
Open
Nobody has claimed this yet.
type:question
- Dominant language
- JavaScript
- Stars
- 21.4k
- Forks
- 4.8k
- Avg merge
- 7h 45m
- Merged PRs (30d)
- 11
Description
New Feature / Enhancement Checklist
- I am not disclosing a vulnerability.
- I am not just asking a question.
- I have searched through existing issues.
Current Limitation
No way to disable graphql introspection
Feature / Enhancement Description
Add a masterKeyOnlyGraphQLIntrospection option. That only allow the master key to perform a full schema introspection.
Example Use Case
masterKeyOnlyGraphQLIntrospection: true
Alternatives / Workarounds
None
3rd Party References
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files, tests, or entry points are named. Start by locating Parse Server's GraphQL configuration and introspection handling, then trace how master-key authorization is represented. Done means a documented option such as masterKeyOnlyGraphQLIntrospection restricts full schema introspection to master-key requests, with coverage for both authorized and unauthorized access.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- graphql, javascript, nodejs
- Domain
- api, backend, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100