Introspection control in GraphQL - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ query_result

intermediate

What is the result of this introspection query when introspection is disabled?

Given a GraphQL server with introspection disabled, what will be the result of this query?

{ __schema { types { name } } }

GraphQL

{ __schema { types { name } } }

A An error indicating introspection is not allowed

B A list of all types in the schema

C An empty list of types

D A null response with no error

💡 Hint

Think about what disabling introspection means for queries that request schema details.

When introspection is disabled, queries requesting __schema or __type fields will return an error because the server forbids access to schema details.

📝 Syntax

intermediate

Which option correctly disables introspection in a GraphQL server using Apollo Server?

Choose the correct code snippet to disable introspection in Apollo Server.

GraphQL

const server = new ApolloServer({ typeDefs, resolvers, introspection: ??? });

A false

B true

C "false"

D null

💡 Hint

Disabling introspection requires a boolean false, not a string or null.

Setting the introspection option to false disables introspection queries in Apollo Server.

❓ optimization

advanced

How does disabling introspection improve GraphQL server security?

Which of the following best explains the security benefit of disabling introspection?

A Automatically encrypts all data sent over the network

B Improves query execution speed by caching introspection results

C Allows anonymous users to access all data without restrictions

D Prevents clients from discovering schema details that could be exploited

💡 Hint

Think about what information introspection reveals to clients.

Disabling introspection stops clients from querying schema details, reducing the risk of attackers learning about the API structure and exploiting it.

🔧 Debug

advanced

Why does this introspection query cause an error despite introspection being enabled?

Given this query:

{ __type(name: "User") { fields { name } } }

and introspection enabled, why might it still cause an error?

A The fields selection is missing required subfields

B The query syntax is invalid

C The type "User" does not exist in the schema

D Introspection is disabled on the server

💡 Hint

Check if the type name is defined in the schema.

If the type "User" is not defined in the schema, the __type query returns null or an error because it cannot find that type.

🧠 Conceptual

expert

What is the impact of selectively allowing introspection only for authenticated users?

Consider a GraphQL server that disables introspection for anonymous users but enables it for authenticated users. What is the main impact of this configuration?

A All users can introspect, but only authenticated users can execute mutations

B Anonymous users cannot explore schema details, reducing attack surface; authenticated users can introspect for development and debugging

C Introspection is disabled globally, so no user can query schema details

D Authenticated users lose access to introspection, increasing security risks

💡 Hint

Think about balancing security and usability for different user roles.

This approach protects schema details from anonymous users who might exploit them, while allowing trusted users to introspect for legitimate purposes.

Practice

1. What is the main purpose of introspection control in GraphQL?

easy

A. To speed up database queries by caching results

B. To allow or block schema queries for security and performance

C. To automatically generate API documentation

D. To encrypt data sent between client and server

Solution

1. Step 1: Understand what introspection means in GraphQL

   Introspection allows clients to query the schema itself to learn about types and fields.

2. Step 2: Identify the purpose of controlling introspection

   Controlling introspection lets you block or allow these schema queries to protect your API and improve performance.

3. Final Answer:

   To allow or block schema queries for security and performance -> Option B

4. Quick Check:

   Introspection control = Allow/block schema queries [OK]

Hint: Introspection controls schema query access, not data fetching [OK]

Common Mistakes:

• Confusing introspection with data query optimization
• Thinking introspection encrypts data
• Assuming introspection auto-generates docs

2. Which of the following is the correct way to disable introspection in a GraphQL server setup?

easy

A. introspection: 'off'

B. introspection = false

C. disableIntrospection: true

D. introspection: false

Solution

1. Step 1: Recall the syntax for toggling introspection in GraphQL server config

   The option is usually set as introspection: true or introspection: false.

2. Step 2: Identify the correct syntax to disable introspection

   Setting introspection: false disables introspection queries.

3. Final Answer:

   introspection: false -> Option D

4. Quick Check:

   Disable introspection = introspection: false [OK]

Hint: Use boolean false, not strings or other keys [OK]

Common Mistakes:

• Using assignment (=) instead of colon (:)
• Using string values instead of boolean
• Using incorrect option names like disableIntrospection

3. Given this GraphQL server config snippet:

const server = new ApolloServer({
  typeDefs,
  resolvers,
  introspection: false
});

What will happen if a client sends an introspection query?

medium

A. The server will return an error or empty response

B. The server will respond with the full schema details

C. The server will ignore the introspection query and respond normally

D. The server will crash due to unsupported query

Solution

1. Step 1: Understand the effect of introspection: false

   This setting disables introspection queries, so the server blocks schema queries.

2. Step 2: Predict server response to introspection query

   The server will reject the introspection query, usually returning an error or empty result.

3. Final Answer:

   The server will return an error or empty response -> Option A

4. Quick Check:

   introspection: false blocks schema queries [OK]

Hint: introspection false means introspection queries fail [OK]

Common Mistakes:

• Thinking server still returns schema data
• Assuming server crashes on introspection query
• Believing server ignores introspection queries silently

4. You wrote this server setup:

const server = new ApolloServer({
  typeDefs,
  resolvers,
  introspection: 'false'
});

Why does introspection control not work as expected?

medium

A. Because ApolloServer does not support introspection control

B. Because introspection must be set to true to disable it

C. Because introspection expects a boolean, not a string

D. Because typeDefs is missing introspection schema

Solution

1. Step 1: Check the data type of the introspection option

   The option should be a boolean (true or false), not a string.

2. Step 2: Identify why using a string causes failure

   Using 'false' as a string is truthy in JavaScript, so introspection remains enabled.

3. Final Answer:

   Because introspection expects a boolean, not a string -> Option C

4. Quick Check:

   introspection must be boolean, not string [OK]

Hint: Use true/false without quotes for boolean options [OK]

Common Mistakes:

• Using string 'false' instead of boolean false
• Thinking introspection must be true to disable
• Assuming ApolloServer lacks introspection control

5. You want to improve API security by disabling introspection only in production but keep it enabled in development. Which code snippet correctly implements this?

hard

A. const server = new ApolloServer({ typeDefs, resolvers, introspection: process.env.NODE_ENV !== 'production' });

B. const server = new ApolloServer({ typeDefs, resolvers, introspection: process.env.NODE_ENV === 'production' });

C. const server = new ApolloServer({ typeDefs, resolvers, introspection: false });

D. const server = new ApolloServer({ typeDefs, resolvers, introspection: true });

Solution

1. Step 1: Understand the goal

   Disable introspection in production, enable in development.

2. Step 2: Analyze each option's logic

   const server = new ApolloServer({ typeDefs, resolvers, introspection: process.env.NODE_ENV !== 'production' }); sets introspection to true when not in production, false in production, matching the goal.

3. Final Answer:

   const server = new ApolloServer({ typeDefs, resolvers, introspection: process.env.NODE_ENV !== 'production' }); -> Option A

4. Quick Check:

   introspection enabled only if not production [OK]

Hint: Use environment check with !== 'production' for introspection [OK]

Common Mistakes:

• Using === 'production' enables introspection in production
• Always setting introspection true or false ignores environment
• Confusing production and development environment logic