Schema visibility control in GraphQL - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ query_result

intermediate

What is the result of querying a hidden field?

Consider a GraphQL schema where the field secretInfo is marked as hidden using schema visibility control. What will be the result when a client queries secretInfo?

GraphQL

query {
  secretInfo
}

A The query returns an error indicating <code>secretInfo</code> does not exist.

B The query returns the value of <code>secretInfo</code> as normal.

C The query returns <code>null</code> for <code>secretInfo</code> without error.

D The query returns all fields except <code>secretInfo</code> silently.

💡 Hint

Think about how schema visibility hides fields from clients.

If a field is hidden by schema visibility control, it is removed from the schema exposed to clients. Querying it causes an error because the client does not see it as a valid field.

🧠 Conceptual

intermediate

Why use schema visibility control in GraphQL?

Which of the following is the main reason to use schema visibility control in a GraphQL API?

A To improve query performance by caching hidden fields.

B To allow clients to modify the schema dynamically.

C To automatically generate documentation for all fields.

D To restrict access to sensitive fields based on client roles.

💡 Hint

Think about controlling what clients can see.

Schema visibility control is used to hide sensitive or restricted fields from clients who should not access them, often based on roles or permissions.

📝 Syntax

advanced

Identify the correct way to hide a field in GraphQL SDL

Given the following GraphQL SDL snippet, which option correctly hides the internalNotes field using a directive @hidden?

GraphQL

type Product {
  id: ID!
  name: String!
  internalNotes: String @hidden
}

A

type Product {
  id: ID!
  name: String!
  internalNotes: String @hidden
}

B

type Product {
  id: ID!
  name: String!
  internalNotes: String @private
}

C

type Product {
  id: ID!
  name: String!
  internalNotes: String hidden
}

D

type Product {
  id: ID!
  name: String!
  internalNotes: String #hidden
}

💡 Hint

Directives start with @ in SDL.

In GraphQL SDL, directives are prefixed with @. Using @hidden is the correct way to mark a field as hidden if the schema supports that directive.

❓ optimization

advanced

How does schema visibility control improve API security?

Which of the following best explains how schema visibility control enhances security in a GraphQL API?

A By limiting the number of queries a client can send per minute.

B By preventing clients from discovering and querying sensitive fields.

C By automatically validating all input data types.

D By encrypting all data sent over the network.

💡 Hint

Think about what clients can see in the schema.

Schema visibility control hides sensitive fields from the schema exposed to clients, so clients cannot even see or query those fields, reducing attack surface.

🔧 Debug

expert

Why does this query fail when using schema visibility control?

Given a GraphQL schema where the adminNotes field is hidden for non-admin users, a non-admin client runs this query:

query {
  product(id: "123") {
    id
    name
    adminNotes
  }
}

Why does this query fail?

A Because the query syntax is invalid due to missing brackets.

B Because the <code>product</code> type does not have an <code>adminNotes</code> field at all.

C Because <code>adminNotes</code> is not visible in the schema for this client, causing a validation error.

D Because the client does not have permission to query <code>id</code> and <code>name</code> fields.

💡 Hint

Consider what happens when a field is hidden from a client.

The adminNotes field is hidden for non-admin clients, so it is not part of the schema they see. Querying it causes a validation error because the field is unknown.