Apollo-server-express introspection disabled but still possible over websocket connections

Question

We use apollo-server-express to expose a graphql server.

For this server, we have set the introspection variable to false to hide our schema from the outer world which works fine for Graphql calls that go over rest calls.

However, when we set up a websocket connection with this same server, we manage to execute introspection queries, even though that during the instantiation of the apollo server, the introspection is explicitly set to false

the config for booting the Apollo-server looks something like this:

{
   schema: <schema>,
   context: <context_function>,
   formatError: <format_error_function>,
   debug: false,
   tracing: false,
   subscriptions: {
       path: <graphQl_path>,
       keepAlive: <keep_alive_param>,
       onConnect: <connect_function>,
       onDisconnect: <disconnect_function>
   },
   introspection: false,
   playground: false
};

Did someone had a similar issue? And if yes, were you able to solve it and how?

apollo-server-express version = 2.1.0

npm version = 6.4.1

node version = 10.13.0

Answer 1

What ApolloServer does internally is prevent you from using the __schema and __type resolvers. I assume you could do the same thing:

export const resolvers = {
  Query: {
    __type() {
      throw new Error('You cannot make introspection');
    },
    __schema() {
      throw new Error('You cannot make introspection');
    }
  }
}