Introspection control in GraphQL - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ query_result

intermediate

What is the result of this introspection query when introspection is disabled?

Given a GraphQL server with introspection disabled, what will be the result of this query?

{ __schema { types { name } } }

GraphQL

{ __schema { types { name } } }

A An error indicating introspection is not allowed

B A list of all types in the schema

C An empty list of types

D A null response with no error

💡 Hint

Think about what disabling introspection means for queries that request schema details.

When introspection is disabled, queries requesting __schema or __type fields will return an error because the server forbids access to schema details.

📝 Syntax

intermediate

Which option correctly disables introspection in a GraphQL server using Apollo Server?

Choose the correct code snippet to disable introspection in Apollo Server.

GraphQL

const server = new ApolloServer({ typeDefs, resolvers, introspection: ??? });

A false

B true

C "false"

D null

💡 Hint

Disabling introspection requires a boolean false, not a string or null.

Setting the introspection option to false disables introspection queries in Apollo Server.

❓ optimization

advanced

How does disabling introspection improve GraphQL server security?

Which of the following best explains the security benefit of disabling introspection?

A Automatically encrypts all data sent over the network

B Improves query execution speed by caching introspection results

C Allows anonymous users to access all data without restrictions

D Prevents clients from discovering schema details that could be exploited

💡 Hint

Think about what information introspection reveals to clients.

Disabling introspection stops clients from querying schema details, reducing the risk of attackers learning about the API structure and exploiting it.

🔧 Debug

advanced

Why does this introspection query cause an error despite introspection being enabled?

Given this query:

{ __type(name: "User") { fields { name } } }

and introspection enabled, why might it still cause an error?

A The fields selection is missing required subfields

B The query syntax is invalid

C The type "User" does not exist in the schema

D Introspection is disabled on the server

💡 Hint

Check if the type name is defined in the schema.

If the type "User" is not defined in the schema, the __type query returns null or an error because it cannot find that type.

🧠 Conceptual

expert

What is the impact of selectively allowing introspection only for authenticated users?

Consider a GraphQL server that disables introspection for anonymous users but enables it for authenticated users. What is the main impact of this configuration?

A All users can introspect, but only authenticated users can execute mutations

B Anonymous users cannot explore schema details, reducing attack surface; authenticated users can introspect for development and debugging

C Introspection is disabled globally, so no user can query schema details

D Authenticated users lose access to introspection, increasing security risks

💡 Hint

Think about balancing security and usability for different user roles.

This approach protects schema details from anonymous users who might exploit them, while allowing trusted users to introspect for legitimate purposes.