parse-community / parse-community/parse-server

Graphql introspection with masterkey does not work when NODE_ENV is production

Open
#9,900 20 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

type:bug
Dominant language
JavaScript
Stars
21.4k
Forks
4.8k
Avg merge
7h 45m
Merged PRs (30d)
11

Description

New Issue Checklist
Issue Description

The GQL introspection endpoint is blocked for environments with NODE_ENV=production even when requesting it with masterkey.

As I understand it from this PR introspection should always work when masterKey is used, but since the introspection boolean on ApolloServer defaults to false the request is blocked even though it's not stopped by the introspection plugin.

Steps to reproduce

Run server without setting graphQLPublicIntrospection to true, set NODE_ENV to production and run an introspection request with master key.

Actual Outcome

{"errors":[{"message":"GraphQL introspection is not allowed by Apollo Server, but the query contained __schema or __type. To enable introspection, pass introspection: true to ApolloServer in production","locations":[{"line":2,"column":3}],"extensions":{"validationErrorCode":"INTROSPECTION_DISABLED","code":"GRAPHQL_VALIDATION_FAILED"}}]}

Expected Outcome

< introspection result >

Environment

7.5.3

Server

  • Parse Server version: 7.5.3
  • Operating system: MacOS
  • Local or remote host (AWS, Azure, Google Cloud, Heroku, Digital Ocean, etc): Heroku

Database

  • System (MongoDB or Postgres): Mongo
  • Database version: 7
  • Local or remote host (MongoDB Atlas, mLab, AWS, Azure, Google Cloud, etc): MongoDB Atlas

Client

  • SDK (iOS, Android, JavaScript, PHP, Unity, etc): FILL_THIS_OUT
  • SDK version: FILL_THIS_OUT
Logs

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing PR #9820 and the GraphQL endpoint's ApolloServer configuration, then reproduce the request with NODE_ENV=production, masterKey, and graphQLPublicIntrospection disabled. Done means a master-key introspection request returns the introspection result without enabling public introspection.

Written by the indexing model from the issue text.

Assessment

Tech stack
graphql, javascript, node.js
Domain
api, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.