Disable suggestions in errors message

Context

We have some mutation defined:

  extend type Mutation {
    updateUserDetail(input: UpdateUserDetailsInput!): UpdateUserDetailsPayload
  }

The user sends the following query:

mutation {
  updateUserDetil {
    user {
        id
    }
  }
}

The server will response with an error maintaining in the message: "message": "Cannot query field \"updateUserDetil\" on type \"Mutation\". Did you mean \"updateUserDetail\"?",

The problem

In case of a private API, we generally want to avoid leaking information about our API. Disabling the introspection is a good step, but the recommendations are leaking some information that can be used by attackers. This talk discuss this issue (from the perspective of a pentester).

Propositions

1. Remove suggestions for any environment that is not development
2. Add a setting to force override the previous change

[DeeJEarl88]

Just found a work around for this and thought i’d share. Use the FormatError feature and mask any errors you don’t want the client seeing. In my case i mask them all.

const apolloServer = new ApolloServer({
  typeDefs: globalTypeDefs,
  resolvers: globalResolvers,
  context:  () => {},
  datasources: () => {},
  ...
  // Mask errors from clients to mitigate security attacks
  formatError: (err) => {
    if (process.env.APP_ENV === 'production') {
      captureException(err);
      return new Error('Internal Server Error');
    }
    return err;
  },
});

[enriquedacostacambio]

@supermonkeybrainz sort of a hack, but you could use either fork graphql-js or use patch-package to add this single line:

diff --git a/node_modules/graphql/jsutils/didYouMean.js b/node_modules/graphql/jsutils/didYouMean.js
index 43640da..da8daf9 100644
--- a/node_modules/graphql/jsutils/didYouMean.js
+++ b/node_modules/graphql/jsutils/didYouMean.js
@@ -11,6 +11,7 @@ var MAX_SUGGESTIONS = 5;
 
 // eslint-disable-next-line no-redeclare
 function didYouMean(firstArg, secondArg) {
+  return ''; // until https://github.com/graphql/graphql-js/issues/2247 or https://github.com/apollographql/apollo-server/issues/3919 are resolved.
   var _ref = typeof firstArg === 'string' ? [firstArg, secondArg] : [undefined, firstArg],
       subMessage = _ref[0],
       suggestions = _ref[1];