Requiring auth header for introspection queries

I’m wondering if there’s a way to allow introspection queries only when a valid authorization header is passed.

I have introspection disabled outside development, but our client app needs to fetch the schema to be used in code generation for the iOS Apollo client as described here: https://www.apollographql.com/docs/ios/downloading-schema.html

Currently it looks like I can only enable or disable configuration via a boolean introspection option passed in the config to the ApolloServer constructor.

I’d like to allow the client developer access to that introspection query if they include a valid internal token in the auth header. Is that possible?

[the-noob]

It is not possible at the moment but I’m also looking for something similar. Ideally introspection should be changed to be a bool or function that receives the request as contextand returnstrue/false`.

[danielmahon]

@nether-cat Would this be a valid way of protecting JUST the introspection query? I still want certain unauthorized queries to pass, like a login.

This plugin is currently checking for 3 things:

1. If the query includes __schema.
2. If the query includes __type.
3. Requires an authorization header if __schema or __type is found in the query.

Am I missing any obvious loopholes? Is there a better way to do this now?

NOTE: Invalid authorization headers may pass this check but are caught in my context middleware, where if there is an authorization header, it is validated.

const secureIntrospection = {
  requestDidStart: ({ request, context }) => {
    if (
      (request.query.includes('__schema') ||
        request.query.includes('__type')) &&
      !context.req.get('authorization')
    ) {
      throw new AuthenticationError('GraphQL introspection not authorized!');
    }
  },
};

const graphQLServer = new ApolloServer({
  schema: schemaWithMiddleware,
  context: contextMiddleware,
  engine: { apiKey: CONFIG.ENGINE_API_KEY },
  subscriptions: { path: '/' },
  plugins: [secureIntrospection],
  introspection: true,
  // Development only
  playground: CONFIG.IS_DEVELOPMENT,
  debug: CONFIG.IS_DEVELOPMENT,
  tracing: CONFIG.IS_DEVELOPMENT,
});