Introspection control in GraphQL - Step-by-Step Execution

Concept Flow - Introspection control

Client sends introspection query

↓

Server receives query

↓

Check introspection enabled?

No→Reject or block query

Yes↓

Server processes introspection query

↓

Server returns schema details

↓

Client receives schema info

The client sends an introspection query, the server checks if introspection is allowed, then either processes or blocks the query, returning schema details if allowed.

Execution Sample

GraphQL

query IntrospectionQuery {
  __schema {
    types {
      name
    }
  }
}

This query asks the server for the list of all types in the schema if introspection is enabled.

Execution Table

Step	Action	Introspection Enabled?	Result	Output
1	Client sends introspection query	Unknown	Query received by server	No output yet
2	Server checks introspection setting	Yes	Introspection allowed	Proceed to process query
3	Server processes __schema request	Yes	Fetch schema types	List of type names
4	Server sends response	Yes	Response sent to client	{"data":{"__schema":{"types":[{"name":"Query"},{"name":"User"},{"name":"String"}]}}}
5	Client receives response	Yes	Client can use schema info	Schema details available
6	Server checks introspection setting	No	Introspection blocked	Error or empty response
7	Server sends error response	No	Response sent to client	{"errors":[{"message":"Introspection disabled"}]}

💡 Execution stops after sending response or error depending on introspection setting.

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	Final
introspection_enabled	Unknown	Yes or No	Yes or No	Yes or No	Yes or No
query_received	No	Yes	Yes	Yes	Yes
response	None	None	Schema data or error	Sent to client	Sent to client

Key Moments - 2 Insights

Why does the server sometimes block introspection queries?

Because introspection_enabled is set to No (see execution_table rows 6 and 7), the server rejects introspection queries to prevent clients from seeing schema details.

What happens if introspection is enabled?

The server processes the introspection query and returns schema information (see execution_table rows 2 to 5).

Visual Quiz - 3 Questions

Look at the execution_table, at which step does the server decide if introspection is allowed?

A Step 1

B Step 2

C Step 4

D Step 6

💡 Hint

Check the 'Introspection Enabled?' column in execution_table row 2.

According to variable_tracker, what is the value of 'response' after step 3 if introspection is enabled?

A None

B Error message

C Schema data

D Query not received

💡 Hint

Look at 'response' variable values in variable_tracker after step 3.

If introspection_enabled is No, what output does the server send according to execution_table?

A Error message 'Introspection disabled'

B Schema details

C List of type names

D Empty response

💡 Hint

See execution_table rows 6 and 7 for output when introspection is blocked.

Concept Snapshot

Introspection control in GraphQL:
- Client sends introspection query
- Server checks if introspection is enabled
- If yes, server returns schema info
- If no, server blocks query with error
- Control protects schema details from unauthorized access

Full Transcript

In GraphQL, introspection control means the server decides if it allows clients to ask about the schema. When a client sends an introspection query, the server checks if introspection is enabled. If it is, the server processes the query and returns schema details like type names. If not, the server blocks the query and sends an error message. This protects the schema from being exposed when not desired. The execution table shows each step from receiving the query, checking settings, processing or blocking, and sending the response. The variable tracker shows how key variables like introspection_enabled and response change during execution.

Practice

1. What is the main purpose of introspection control in GraphQL?

easy

A. To speed up database queries by caching results

B. To allow or block schema queries for security and performance

C. To automatically generate API documentation

D. To encrypt data sent between client and server

Solution

1. Step 1: Understand what introspection means in GraphQL

   Introspection allows clients to query the schema itself to learn about types and fields.

2. Step 2: Identify the purpose of controlling introspection

   Controlling introspection lets you block or allow these schema queries to protect your API and improve performance.

3. Final Answer:

   To allow or block schema queries for security and performance -> Option B

4. Quick Check:

   Introspection control = Allow/block schema queries [OK]

Hint: Introspection controls schema query access, not data fetching [OK]

Common Mistakes:

• Confusing introspection with data query optimization
• Thinking introspection encrypts data
• Assuming introspection auto-generates docs

2. Which of the following is the correct way to disable introspection in a GraphQL server setup?

easy

A. introspection: 'off'

B. introspection = false

C. disableIntrospection: true

D. introspection: false

Solution

1. Step 1: Recall the syntax for toggling introspection in GraphQL server config

   The option is usually set as introspection: true or introspection: false.

2. Step 2: Identify the correct syntax to disable introspection

   Setting introspection: false disables introspection queries.

3. Final Answer:

   introspection: false -> Option D

4. Quick Check:

   Disable introspection = introspection: false [OK]

Hint: Use boolean false, not strings or other keys [OK]

Common Mistakes:

• Using assignment (=) instead of colon (:)
• Using string values instead of boolean
• Using incorrect option names like disableIntrospection

3. Given this GraphQL server config snippet:

const server = new ApolloServer({
  typeDefs,
  resolvers,
  introspection: false
});

What will happen if a client sends an introspection query?

medium

A. The server will return an error or empty response

B. The server will respond with the full schema details

C. The server will ignore the introspection query and respond normally

D. The server will crash due to unsupported query

Solution

1. Step 1: Understand the effect of introspection: false

   This setting disables introspection queries, so the server blocks schema queries.

2. Step 2: Predict server response to introspection query

   The server will reject the introspection query, usually returning an error or empty result.

3. Final Answer:

   The server will return an error or empty response -> Option A

4. Quick Check:

   introspection: false blocks schema queries [OK]

Hint: introspection false means introspection queries fail [OK]

Common Mistakes:

• Thinking server still returns schema data
• Assuming server crashes on introspection query
• Believing server ignores introspection queries silently

4. You wrote this server setup:

const server = new ApolloServer({
  typeDefs,
  resolvers,
  introspection: 'false'
});

Why does introspection control not work as expected?

medium

A. Because ApolloServer does not support introspection control

B. Because introspection must be set to true to disable it

C. Because introspection expects a boolean, not a string

D. Because typeDefs is missing introspection schema

Solution

1. Step 1: Check the data type of the introspection option

   The option should be a boolean (true or false), not a string.

2. Step 2: Identify why using a string causes failure

   Using 'false' as a string is truthy in JavaScript, so introspection remains enabled.

3. Final Answer:

   Because introspection expects a boolean, not a string -> Option C

4. Quick Check:

   introspection must be boolean, not string [OK]

Hint: Use true/false without quotes for boolean options [OK]

Common Mistakes:

• Using string 'false' instead of boolean false
• Thinking introspection must be true to disable
• Assuming ApolloServer lacks introspection control

5. You want to improve API security by disabling introspection only in production but keep it enabled in development. Which code snippet correctly implements this?

hard

A. const server = new ApolloServer({ typeDefs, resolvers, introspection: process.env.NODE_ENV !== 'production' });

B. const server = new ApolloServer({ typeDefs, resolvers, introspection: process.env.NODE_ENV === 'production' });

C. const server = new ApolloServer({ typeDefs, resolvers, introspection: false });

D. const server = new ApolloServer({ typeDefs, resolvers, introspection: true });

Solution

1. Step 1: Understand the goal

   Disable introspection in production, enable in development.

2. Step 2: Analyze each option's logic

   const server = new ApolloServer({ typeDefs, resolvers, introspection: process.env.NODE_ENV !== 'production' }); sets introspection to true when not in production, false in production, matching the goal.

3. Final Answer:

   const server = new ApolloServer({ typeDefs, resolvers, introspection: process.env.NODE_ENV !== 'production' }); -> Option A

4. Quick Check:

   introspection enabled only if not production [OK]

Hint: Use environment check with !== 'production' for introspection [OK]

Common Mistakes:

• Using === 'production' enables introspection in production
• Always setting introspection true or false ignores environment
• Confusing production and development environment logic