How to remove authentication for introspection query in Graphql

Question

so may be this is very basic question so please bear with me. Let me explain what I am doing and what I really need.

---

EXPLANATION

---

I have created a graphql server by using ApolloGraphql (apollo-server-express npm module).

Here is the code snippet to give you an idea.

api.js

import express from 'express'
import rootSchema from './root-schema'
.... // some extra code
app = express.router()
app.use(jwtaAuthenticator) // --> this code authenticates Authorization header
.... // some more middleware's added
const graphQLServer = new ApolloServer({
  schema: rootSchema, // --> this is root schema object
  context: context => context,
  introspection: true, 
})
graphQLServer.applyMiddleware({ app, path: '/graphql' })

server.js

import http from 'http'
import express from 'express'
import apiRouter from './api' // --> the above file
const app = express()
app.use([some middlewares])
app.use('/', apiRouter)
....
....
export async function init () {

try {
  const httpServer = http.createServer(app)
  httpServer
    .listen(PORT)
    .on('error', (err) => { setTimeout(() => process.exit(1), 5000) })
  } catch (err) {
    setTimeout(() => process.exit(1), 5000)
  }
  console.log('Server started --- ', PORT)
}
export default app

index.js

require('babel-core')
require('babel-polyfill')
require = require('esm')(module/* , options */)
const server = require('./server.js') // --> the above file

server.init()

---

PROBLEM STATEMENT

---

I am using node index.js to start the app. So, the app is expecting Authorization header (JWT token) to be present all the times, even for the introspection query. But this is not what I want, I want that introspection query will be resolvable even without the token. So that anyone can see the documentation.

Please shed some light and please guide what is the best approach to do so. Happy coding :)

Answer 1

.startsWith('query Introspection') is insecure because any query can be named Introspection.

The better approach is to check the whole query.

First import graphql and prepare introspection query string:

const { parse, print, getIntrospectionQuery } = require('graphql');
// format introspection query same way as apollo tooling do
const introspectionQuery = print(parse(getIntrospectionQuery()));

Then in Apollo Server configuration check query:

context: ({ req }) => {
  // allow introspection query
  if (req.body.query === introspectionQuery) {
    return {};
  }

  // continue
}

Answer 2

There's a ton of different ways to handle authorization in GraphQL, as illustrated in the docs:

• Adding middleware for express (or some other framework like hapi or koa)
• Checking for authorization inside individual resolvers
• Checking for authorization inside your data models
• Utilizing custom directives

Adding express middleware is great for preventing unauthorized access to your entire schema. If you want to allow unauthenticated access to some fields but not others, it's generally recommended you move your authorization logic from the framework layer to the GraphQL or data model layer using one of the methods above.