Introspection control in GraphQL - Mini Project: Build & Apply

GraphQL Introspection Control

📖 Scenario: You are building a GraphQL API for a simple book store. You want to control introspection queries to improve security by disabling introspection in production.

🎯 Goal: Create a GraphQL schema with introspection control. You will first define the schema, then add a configuration variable to enable or disable introspection, implement the logic to check this variable, and finally complete the schema setup with introspection control.

📋 What You'll Learn

Define a simple GraphQL schema with a Book type and a Query type

Add a configuration variable called introspection_enabled to control introspection

Implement logic to disable introspection queries when introspection_enabled is false

Complete the schema setup with introspection control applied

💡 Why This Matters

🌍 Real World

Controlling introspection in GraphQL APIs helps protect sensitive schema details in production environments.

💼 Career

Many companies require secure GraphQL APIs; knowing how to enable or disable introspection is a valuable skill for backend developers.

1

Define the GraphQL schema with Book and Query types

Create a GraphQL schema string called schema_definition that defines a Book type with fields id (ID!), title (String!), and author (String!). Also define a Query type with a field books that returns a list of Book.

GraphQL

# Create a variable called schema_definition with the GraphQL schema string
# Your code here

Hint

Use triple quotes to create a multi-line string for the schema.

2

Add configuration variable to control introspection

Create a boolean variable called introspection_enabled and set it to False to disable introspection.

GraphQL

schema_definition = '''
type Book {
  id: ID!
  title: String!
  author: String!
}

type Query {
  books: [Book]
}
'''

# Create a boolean variable called introspection_enabled and set it to False
# Your code here

Hint

Use False to disable introspection.

3

Implement logic to disable introspection queries

Create a function called is_introspection_allowed that returns the value of introspection_enabled. This function will be used to check if introspection queries are allowed.

GraphQL

schema_definition = '''
type Book {
  id: ID!
  title: String!
  author: String!
}

type Query {
  books: [Book]
}
'''

introspection_enabled = False

# Define a function called is_introspection_allowed that returns introspection_enabled
# Your code here

Hint

Define a simple function that returns the boolean variable.

4

Complete schema setup with introspection control

Create a variable called schema_config as a dictionary with keys 'schema' set to schema_definition and 'introspection' set to the function is_introspection_allowed. This config will control introspection in the GraphQL server.

GraphQL

schema_definition = '''
type Book {
  id: ID!
  title: String!
  author: String!
}

type Query {
  books: [Book]
}
'''

introspection_enabled = False

def is_introspection_allowed():
    return introspection_enabled

# Create a dictionary called schema_config with keys 'schema' and 'introspection'
# Your code here

Hint

Use a dictionary to hold the schema and introspection control function.

Practice

1. What is the main purpose of introspection control in GraphQL?

easy

A. To speed up database queries by caching results

B. To allow or block schema queries for security and performance

C. To automatically generate API documentation

D. To encrypt data sent between client and server

Solution

1. Step 1: Understand what introspection means in GraphQL

   Introspection allows clients to query the schema itself to learn about types and fields.

2. Step 2: Identify the purpose of controlling introspection

   Controlling introspection lets you block or allow these schema queries to protect your API and improve performance.

3. Final Answer:

   To allow or block schema queries for security and performance -> Option B

4. Quick Check:

   Introspection control = Allow/block schema queries [OK]

Hint: Introspection controls schema query access, not data fetching [OK]

Common Mistakes:

• Confusing introspection with data query optimization
• Thinking introspection encrypts data
• Assuming introspection auto-generates docs

2. Which of the following is the correct way to disable introspection in a GraphQL server setup?

easy

A. introspection: 'off'

B. introspection = false

C. disableIntrospection: true

D. introspection: false

Solution

1. Step 1: Recall the syntax for toggling introspection in GraphQL server config

   The option is usually set as introspection: true or introspection: false.

2. Step 2: Identify the correct syntax to disable introspection

   Setting introspection: false disables introspection queries.

3. Final Answer:

   introspection: false -> Option D

4. Quick Check:

   Disable introspection = introspection: false [OK]

Hint: Use boolean false, not strings or other keys [OK]

Common Mistakes:

• Using assignment (=) instead of colon (:)
• Using string values instead of boolean
• Using incorrect option names like disableIntrospection

3. Given this GraphQL server config snippet:

const server = new ApolloServer({
  typeDefs,
  resolvers,
  introspection: false
});

What will happen if a client sends an introspection query?

medium

A. The server will return an error or empty response

B. The server will respond with the full schema details

C. The server will ignore the introspection query and respond normally

D. The server will crash due to unsupported query

Solution

1. Step 1: Understand the effect of introspection: false

   This setting disables introspection queries, so the server blocks schema queries.

2. Step 2: Predict server response to introspection query

   The server will reject the introspection query, usually returning an error or empty result.

3. Final Answer:

   The server will return an error or empty response -> Option A

4. Quick Check:

   introspection: false blocks schema queries [OK]

Hint: introspection false means introspection queries fail [OK]

Common Mistakes:

• Thinking server still returns schema data
• Assuming server crashes on introspection query
• Believing server ignores introspection queries silently

4. You wrote this server setup:

const server = new ApolloServer({
  typeDefs,
  resolvers,
  introspection: 'false'
});

Why does introspection control not work as expected?

medium

A. Because ApolloServer does not support introspection control

B. Because introspection must be set to true to disable it

C. Because introspection expects a boolean, not a string

D. Because typeDefs is missing introspection schema

Solution

1. Step 1: Check the data type of the introspection option

   The option should be a boolean (true or false), not a string.

2. Step 2: Identify why using a string causes failure

   Using 'false' as a string is truthy in JavaScript, so introspection remains enabled.

3. Final Answer:

   Because introspection expects a boolean, not a string -> Option C

4. Quick Check:

   introspection must be boolean, not string [OK]

Hint: Use true/false without quotes for boolean options [OK]

Common Mistakes:

• Using string 'false' instead of boolean false
• Thinking introspection must be true to disable
• Assuming ApolloServer lacks introspection control

5. You want to improve API security by disabling introspection only in production but keep it enabled in development. Which code snippet correctly implements this?

hard

A. const server = new ApolloServer({ typeDefs, resolvers, introspection: process.env.NODE_ENV !== 'production' });

B. const server = new ApolloServer({ typeDefs, resolvers, introspection: process.env.NODE_ENV === 'production' });

C. const server = new ApolloServer({ typeDefs, resolvers, introspection: false });

D. const server = new ApolloServer({ typeDefs, resolvers, introspection: true });

Solution

1. Step 1: Understand the goal

   Disable introspection in production, enable in development.

2. Step 2: Analyze each option's logic

   const server = new ApolloServer({ typeDefs, resolvers, introspection: process.env.NODE_ENV !== 'production' }); sets introspection to true when not in production, false in production, matching the goal.

3. Final Answer:

   const server = new ApolloServer({ typeDefs, resolvers, introspection: process.env.NODE_ENV !== 'production' }); -> Option A

4. Quick Check:

   introspection enabled only if not production [OK]

Hint: Use environment check with !== 'production' for introspection [OK]

Common Mistakes:

• Using === 'production' enables introspection in production
• Always setting introspection true or false ignores environment
• Confusing production and development environment logic