Skip to content

fix(wabe): graphiql access and introspection mechanism #301

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
coratgerl merged 1 commit into from
Feb 20, 2026
Merged

fix(wabe): graphiql access and introspection mechanism #301

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions packages/wabe/src/security.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -497,8 +497,11 @@ describe('Security tests', () => {
await closeTests(wabe)
})

it('should block GraphQL introspection queries for anonymous and authenticated users for isProduction server', async () => {
const setup = await setupTests([], { isProduction: true })
it('should block GraphQL introspection queries for anonymous and authenticated users when disableIntrospection is true', async () => {
const setup = await setupTests([], {
isProduction: true,
disableIntrospection: true,
})
const wabe = setup.wabe
const port = setup.port
const client = getAnonymousClient(port)
Expand Down
216 changes: 203 additions & 13 deletions packages/wabe/src/server/index.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,6 +87,120 @@ describe('Server', () => {
expect(wabe.start()).rejects.toThrow('Authentication session requires jwt secret')
})

it('should return GraphiQL for GET /graphql in development', async () => {
const databaseId = uuid()
const port = await getPort()
const wabe = new Wabe({
isProduction: false,
rootKey: 'eIUbb9abFa8PJGRfRwgiGSCU0fGnLErph2QYjigDRjLsbyNA3fZJ8Npd0FJNzxAc',
database: {
// @ts-expect-error
adapter: await getDatabaseAdapter(databaseId),
},
port,
security: {
disableCSRFProtection: true,
},
schema: {
classes: [
{
name: 'Collection1',
fields: { name: { type: 'String' } },
},
],
},
})

await wabe.start()

const res = await fetch(`http://127.0.0.1:${port}/graphql`, {
method: 'GET',
headers: { Accept: 'text/html' },
})

const text = await res.text()
expect(res.status).toBe(200)
expect(text).toContain('GraphiQL')

await wabe.close()
})

it('should return GraphiQL in production by default', async () => {
const databaseId = uuid()
const port = await getPort()
const wabe = new Wabe({
isProduction: true,
rootKey: 'eIUbb9abFa8PJGRfRwgiGSCU0fGnLErph2QYjigDRjLsbyNA3fZJ8Npd0FJNzxAc',
database: {
// @ts-expect-error
adapter: await getDatabaseAdapter(databaseId),
},
port,
security: {
disableCSRFProtection: true,
},
schema: {
classes: [
{
name: 'Collection1',
fields: { name: { type: 'String' } },
},
],
},
})

await wabe.start()

const res = await fetch(`http://127.0.0.1:${port}/graphql`, {
method: 'GET',
headers: { Accept: 'text/html' },
})

const text = await res.text()
expect(res.status).toBe(200)
expect(text).toContain('GraphiQL')

await wabe.close()
})

it('should not return GraphiQL when disableGraphQLDashboard is true', async () => {
const databaseId = uuid()
const port = await getPort()
const wabe = new Wabe({
isProduction: false,
rootKey: 'eIUbb9abFa8PJGRfRwgiGSCU0fGnLErph2QYjigDRjLsbyNA3fZJ8Npd0FJNzxAc',
database: {
// @ts-expect-error
adapter: await getDatabaseAdapter(databaseId),
},
port,
security: {
disableCSRFProtection: true,
disableGraphQLDashboard: true,
},
schema: {
classes: [
{
name: 'Collection1',
fields: { name: { type: 'String' } },
},
],
},
})

await wabe.start()

const res = await fetch(`http://127.0.0.1:${port}/graphql`, {
method: 'GET',
headers: { Accept: 'text/html' },
})

const text = await res.text()
expect(text).not.toContain('GraphiQL')

await wabe.close()
})

it('should pass graphql options to yoga plugin', async () => {
const databaseId = uuid()

Expand Down Expand Up @@ -115,7 +229,6 @@ describe('Server', () => {
},
security: {
disableCSRFProtection: true,
allowIntrospectionInProduction: true,
maxGraphqlDepth: 60,
},
schema: {
Expand Down Expand Up @@ -519,13 +632,12 @@ describe('Server', () => {
await wabe.close()
})

it('should block introspection in production without root key', async () => {
it('should allow introspection in development by default', async () => {
const databaseId = uuid()
const port = await getPort()
const rootKey = 'eIUbb9abFa8PJGRfRwgiGSCU0fGnLErph2QYjigDRjLsbyNA3fZJ8Npd0FJNzxAc'
const wabe = new Wabe({
isProduction: true,
rootKey,
isProduction: false,
rootKey: 'eIUbb9abFa8PJGRfRwgiGSCU0fGnLErph2QYjigDRjLsbyNA3fZJ8Npd0FJNzxAc',
database: {
// @ts-expect-error
adapter: await getDatabaseAdapter(databaseId),
Expand All @@ -548,9 +660,49 @@ describe('Server', () => {

const res = await fetch(`http://127.0.0.1:${port}/graphql`, {
method: 'POST',
headers: {
'Content-Type': 'application/json',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({
query: '{ __schema { types { name } } }',
}),
})

const json = (await res.json()) as { data?: { __schema?: { types?: { name: string }[] } } }
expect(json.data?.__schema?.types).toBeDefined()
expect(json.data?.__schema?.types?.length).toBeGreaterThan(0)

await wabe.close()
})

it('should block introspection when disableIntrospection is true', async () => {
const databaseId = uuid()
const port = await getPort()
const wabe = new Wabe({
isProduction: false,
rootKey: 'eIUbb9abFa8PJGRfRwgiGSCU0fGnLErph2QYjigDRjLsbyNA3fZJ8Npd0FJNzxAc',
database: {
// @ts-expect-error
adapter: await getDatabaseAdapter(databaseId),
},
port,
security: {
disableCSRFProtection: true,
disableIntrospection: true,
},
schema: {
classes: [
{
name: 'Collection1',
fields: { name: { type: 'String' } },
},
],
},
})

await wabe.start()

const res = await fetch(`http://127.0.0.1:${port}/graphql`, {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({
query: '{ __schema { types { name } } }',
}),
Expand All @@ -563,20 +715,20 @@ describe('Server', () => {
await wabe.close()
})

it('should allow introspection in production with valid root key', async () => {
it('should block introspection in production when disableIntrospection is true', async () => {
const databaseId = uuid()
const port = await getPort()
const rootKey = 'eIUbb9abFa8PJGRfRwgiGSCU0fGnLErph2QYjigDRjLsbyNA3fZJ8Npd0FJNzxAc'
const wabe = new Wabe({
isProduction: true,
rootKey,
rootKey: 'eIUbb9abFa8PJGRfRwgiGSCU0fGnLErph2QYjigDRjLsbyNA3fZJ8Npd0FJNzxAc',
database: {
// @ts-expect-error
adapter: await getDatabaseAdapter(databaseId),
},
port,
security: {
disableCSRFProtection: true,
disableIntrospection: true,
},
schema: {
classes: [
Expand All @@ -592,10 +744,48 @@ describe('Server', () => {

const res = await fetch(`http://127.0.0.1:${port}/graphql`, {
method: 'POST',
headers: {
'Content-Type': 'application/json',
'Wabe-Root-Key': rootKey,
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({
query: '{ __schema { types { name } } }',
}),
})

const json = (await res.json()) as { errors?: { message: string }[] }
expect(json.errors).toBeDefined()
expect(json.errors?.[0]?.message).toContain('introspection')

await wabe.close()
})

it('should allow introspection in production by default', async () => {
const databaseId = uuid()
const port = await getPort()
const wabe = new Wabe({
isProduction: true,
rootKey: 'eIUbb9abFa8PJGRfRwgiGSCU0fGnLErph2QYjigDRjLsbyNA3fZJ8Npd0FJNzxAc',
database: {
// @ts-expect-error
adapter: await getDatabaseAdapter(databaseId),
},
port,
security: {
disableCSRFProtection: true,
},
schema: {
classes: [
{
name: 'Collection1',
fields: { name: { type: 'String' } },
},
],
},
})

await wabe.start()

const res = await fetch(`http://127.0.0.1:${port}/graphql`, {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({
query: '{ __schema { types { name } } }',
}),
Expand Down
10 changes: 5 additions & 5 deletions packages/wabe/src/server/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,15 +18,15 @@ import { FileController } from '../file/FileController'
import { defaultSessionHandler } from './defaultSessionHandler'
import type { CronConfig } from '../cron'
import type { FileConfig } from '../file'
import { isValidRootKey } from '../utils'
import { WobeGraphqlYogaPlugin } from 'wobe-graphql-yoga'

type SecurityConfig = {
corsOptions?: CorsOptions
rateLimit?: RateLimitOptions
hideSensitiveErrorMessage?: boolean
disableCSRFProtection?: boolean
allowIntrospectionInProduction?: boolean
disableGraphQLDashboard?: boolean
disableIntrospection?: boolean
maxGraphqlDepth?: number
}

Expand Down Expand Up @@ -287,8 +287,9 @@ export class Wabe<T extends WabeTypes> {
await this.server.usePlugin(
WobeGraphqlYogaPlugin({
schema: this.config.graphqlSchema,
allowGetRequests: !(this.config.security?.disableGraphQLDashboard ?? false),
maskedErrors: this.config.security?.hideSensitiveErrorMessage || this.config.isProduction,
allowIntrospection: !!this.config.security?.allowIntrospectionInProduction,
allowIntrospection: !(this.config.security?.disableIntrospection ?? false),
maxDepth,
allowMultipleOperations: true,
graphqlEndpoint: '/graphql',
Expand All @@ -297,8 +298,7 @@ export class Wabe<T extends WabeTypes> {
const introspectionDisabled = new WeakSet<Request>()
return {
onRequestParse: ({ request }: { request: Request }) => {
if (this.config.security?.allowIntrospectionInProduction) return
if (isValidRootKey(request.headers, this.config.rootKey)) return
if (!(this.config.security?.disableIntrospection ?? false)) return
introspectionDisabled.add(request)
},
onValidate: ({
Expand Down
4 changes: 4 additions & 0 deletions packages/wabe/src/utils/testHelper.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ export const setupTests = async (
options: {
isProduction?: boolean
disableCSRFProtection?: boolean
disableIntrospection?: boolean
rootKey?: string
rateLimit?: RateLimitOptions
} = {},
Expand All @@ -39,6 +40,9 @@ export const setupTests = async (
security: {
// To make test easier keep default value to true
disableCSRFProtection: options.disableCSRFProtection ?? true,
...(options.disableIntrospection !== undefined && {
disableIntrospection: options.disableIntrospection,
}),
...(options.rateLimit && { rateLimit: options.rateLimit }),
},
authentication: {
Expand Down