Disabling GraphQL introspection requests on production

Question

For company policies reasons I must disable the introspection feature of graphql-ruby gem (making the __schema requests fail / return 404).

How do I achieve this?

The application is based on Ruby on Rails version 5.2.2 and the graphql-ruby gem version is 1.8.12.

Answer 1

From the graphql-ruby documentation:

You can re-implement these fields or create new ones by creating a custom EntryPoints class in your introspection namespace:

module Introspection
  class EntryPoints < GraphQL::Introspection::EntryPoints
    # ...
  end
end

That said, just introduce def __schema method redirecting to 404 or explicitly responding with 404.

---

FWIW, here is the original code you are to overwrite.