parse-community / parse-community/parse-server
Graphql introspection with masterkey does not work when NODE_ENV is production
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 21.4k
- Forks
- 4.8k
- Avg merge
- 7h 45m
- Merged PRs (30d)
- 11
Description
New Issue Checklist
- Report security issues confidentially.
- Any contribution is under this license.
- Before posting search existing issues.
Issue Description
The GQL introspection endpoint is blocked for environments with NODE_ENV=production even when requesting it with masterkey.
As I understand it from this PR introspection should always work when masterKey is used, but since the introspection boolean on ApolloServer defaults to false the request is blocked even though it's not stopped by the introspection plugin.
Steps to reproduce
Run server without setting graphQLPublicIntrospection to true, set NODE_ENV to production and run an introspection request with master key.
Actual Outcome
{"errors":[{"message":"GraphQL introspection is not allowed by Apollo Server, but the query contained __schema or __type. To enable introspection, pass introspection: true to ApolloServer in production","locations":[{"line":2,"column":3}],"extensions":{"validationErrorCode":"INTROSPECTION_DISABLED","code":"GRAPHQL_VALIDATION_FAILED"}}]}
Expected Outcome
< introspection result >
Environment
7.5.3
Server
- Parse Server version:
7.5.3 - Operating system:
MacOS - Local or remote host (AWS, Azure, Google Cloud, Heroku, Digital Ocean, etc):
Heroku
Database
- System (MongoDB or Postgres):
Mongo - Database version:
7 - Local or remote host (MongoDB Atlas, mLab, AWS, Azure, Google Cloud, etc):
MongoDB Atlas
Client
- SDK (iOS, Android, JavaScript, PHP, Unity, etc):
FILL_THIS_OUT - SDK version:
FILL_THIS_OUT
Logs
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing PR #9820 and the GraphQL endpoint's ApolloServer configuration, then reproduce the request with NODE_ENV=production, masterKey, and graphQLPublicIntrospection disabled. Done means a master-key introspection request returns the introspection result without enabling public introspection.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- graphql, javascript, node.js
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100