Registry / security / graphql-disable-introspection

graphql-disable-introspection

library1.2.0jsnpmunverified

A validation rule for graphql-js that disables introspection queries by rejecting any query containing __schema or __type fields. Current stable version is 1.2.0. The package has been in maintenance mode with infrequent updates. It supports a broad range of graphql versions (0.9.x through 15.x). A key differentiator is its simplicity compared to more complex middleware solutions like graphql-no-introspection, though it only blocks specific field names rather than the introspection query system as a whole.

security

npm install graphql-disable-introspection

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · GRAPHQL-DISABLE-IN

graphql-disable-introspection

securityjavascriptv1.2.0

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

NoIntrospection

✓ import NoIntrospection from 'graphql-disable-introspection'

✗ const NoIntrospection = require('graphql-disable-introspection')

CommonJS require works in Node.js, but the package's default export is a validation rule. No named export exists.

noIntrospection

✓ import noIntrospection from 'graphql-disable-introspection'

✗ import { noIntrospection } from 'graphql-disable-introspection'

The package only exports a default; there is no named export. Use any name for the default import.

validation rule

✓ const NoIntrospection = require('graphql-disable-introspection')

✗ No import mistake commonly, but ensure the imported value is passed as a validationRules array element, not directly as a function.

Used in graphql-js execute or middleware's validationRules option.

Demonstrates how to add the rule to an Apollo Server Express or express-graphql setup to block introspection queries.

import express from 'express'; import bodyParser from 'body-parser'; import { graphqlExpress } from 'apollo-server-express'; import schema from './schema'; import NoIntrospection from 'graphql-disable-introspection'; const app = express(); app.use('/graphql', bodyParser.json(), graphqlExpress({ schema, validationRules: [NoIntrospection] })); app.listen(4000); // Alternatively with express-graphql: // import { graphqlHTTP } from 'express-graphql'; // app.use('/graphql', graphqlHTTP({ // schema, // validationRules: [NoIntrospection] // }));

Debug

Known issues

gotchaThe rule only blocks queries containing __schema or __type fields; it does not block the __typename field. Some introspection-like queries may still pass.

fix

Consider using a more comprehensive solution like graphql-no-introspection or extending the rule to block __typename if needed.

affects: all

gotchaThe rule does not block introspection through the __type query that uses field names like '__type' in a fragment or variable? Actually __type is blocked, but __typename is not.

fix

If you need to block __typename, you must implement a custom rule or use another package.

affects: all

gotchaThe rule may be bypassed by using aliases on the __schema or __type fields. The package does not check aliases.

fix

Implement a custom rule that traverses field definitions regardless of alias, or use a more robust introspection blocker.

affects: all

deprecatedThe package is in maintenance mode and has not been actively updated since 2020. It may not support graphql versions beyond 15.x.

fix

Consider migrating to graphql-no-introspection or using built-in options like Apollo Server's 'introspection: false'.

affects: all

Errors

Common errors & fixes

NoIntrospection is not a function

Importing the default export but trying to call it as a function instead of passing it to validationRules array.

fix

Pass NoIntrospection as an element in the array: validationRules: [NoIntrospection]

Error: Unknown validation rule

Using a very old version of graphql-js that does not support the validationRules option (pre-0.10).

fix

Upgrade graphql-js to >=0.10.0 or apply the rule differently.

Cannot find module 'graphql-disable-introspection'

Package not installed or missing from node_modules.

fix

Run 'npm install graphql-disable-introspection' or add it to package.json.

Upgrade

Version history

1.2.0latest on npm

Audit

Dependencies

graphqlrequiredpeer dependency: validation rule interface from graphql-js

Agent activity

15 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/helfer/graphql-disable-introspection ↗

packagegraphql-disable-introspection ↗

homepagehttps://github.com/helfer/graphql-disable-introspection#readme ↗