TentyGraphQL endpoints
A GraphQL endpoint can describe its whole schema to any caller. This feature is called introspection, and it is meant for development tools.
What it is
Introspection answers a query for every type, field, query and mutation the server accepts. Tools such as GraphiQL use it to offer autocomplete. A production server that leaves it on gives the same map to everyone.
Why it matters
The schema shows which queries exist, which changes a caller can make and how the data is shaped. Someone probing an app finds hidden admin operations, internal fields and the exact names to try. Introspection leaves the data itself alone. It shortens the search for a field that returns too much or a mutation that checks too little. Tenty rates the finding medium.
How Tenty checks it
Tenty tries /graphql, /api/graphql, /v1/graphql and any GraphQL path found in your scripts. It sends one read-only request that carries the introspection query in the web address. This runs for verified owners only. The finding gives the number of types and says whether mutations exist. Type names stay out of the report.
How to fix it
Turn introspection off in production and keep the schema file in your repository for your own tools.
- Apollo Server: set
introspection: false. Apollo Server 4 turns it off whenNODE_ENVisproduction. - GraphQL Yoga: add the
@graphql-yoga/plugin-disable-introspectionplugin. - Other servers: look for a setting called introspection, schema exposure or playground in the server options.
Introspection off hides the map. The protection comes from checking permissions on every query and mutation, so review those next.
How to reproduce
curl -sS -G 'https://YOUR-APP/graphql' --data-urlencode 'query={__schema{queryType{name}types{name}}}'A JSON answer with data.__schema means introspection is on. After the fix the server answers with an error.