add middleware to disable introspection query #2348
Conversation
normandy/schema.py
Outdated
| schema = graphene.Schema(query=NormandyQuery) | ||
| class DisableIntrospectionMiddleware: | ||
| """ | ||
| This class hides the introspection. |
There was a problem hiding this comment.
Could you make it explicit why we are doing that?
Link to bug? A few words maybe?
There was a problem hiding this comment.
since there's no bug, i added a link that states its best practice to disable introspection queries. Though, I could create a git issue and reference it?
normandy/schema.py
Outdated
|
|
||
| def resolve(self, next, root, info, **kwargs): | ||
|
|
||
| if info.field_name.lower() in ['__schema', '_introspection']: |
There was a problem hiding this comment.
We are looking for private fields here, where do they come from? A link maybe?
There was a problem hiding this comment.
I changed up the list, with a list that is listed from https://graphql.org/learn/introspection/
|
bors merge |
|
Build succeeded! The publicly hosted instance of bors-ng is deprecated and will go away soon. If you want to self-host your own instance, instructions are here. If you want to switch to GitHub's built-in merge queue, visit their help page. |
used https://docs.graphene-python.org/en/v2.1.8/execution/middleware/ as reference