graphql-tools icon indicating copy to clipboard operation
graphql-tools copied to clipboard

Query does not provide a operation name as a property in the request body causing some server configurations to reject the request

Open cernst11 opened this issue 1 year ago • 0 comments
trafficstars

The Apollo implementation for fetching the schema does not provide an operation name in the boy of the request like so.

{
   "query":"SCHEMA_QUERY",
   "variables":{
      "id":"options.graph",
      "tag":"options.variant"
   },
   "operationName":"GetSchemaByTag"
}

It is common practice to reject queries without an operation names for a variety of reasons. Apollo Server/Federation implementation only exposes the operationName defined in the request body for plugins not in the query causing any teams enabled or created a plugin to reject queries without OperationNames to reject the introspection query.

cernst11 avatar Jan 22 '24 15:01 cernst11