Graphql Introspection in Feathersjs

Remediating GraphQL introspection vulnerabilities in Feathersjs involves both configuration changes and architectural considerations. Here are Feathersjs-specific solutions:

Disable Introspection in Production

The most straightforward fix is to disable introspection when your Feathersjs app runs in production:

const { graphql } = require('@feathersjs/graphql');
const { schema } = require('./schema');

const graphqlConfig = {
  schema,
  introspection: process.env.NODE_ENV === 'development'
};

module.exports = app => {
  app.use('/graphql', graphql(graphqlConfig));
};

This approach allows introspection during development while protecting your production API.

Schema Filtering for Feathersjs

For more granular control, implement schema filtering in your Feathersjs GraphQL setup. This allows you to selectively expose parts of your schema:

const { graphql } = require('@feathersjs/graphql');
const { makeExecutableSchema } = require('@graphql-tools/schema');
const { filterSchema } = require('@graphql-tools/schema');

const originalSchema = makeExecutableSchema({
  typeDefs: fs.readFileSync('./schema.graphql', 'utf8'),
  resolvers: yourResolvers
});

const filteredSchema = filterSchema({
  schema: originalSchema,
  filterIntrospection: process.env.NODE_ENV === 'production',
  ignore: ['Query', 'Mutation'] // Keep root types
});

const graphqlConfig = {
  schema: filteredSchema,
  introspection: process.env.NODE_ENV === 'development'
};

module.exports = app => {
  app.use('/graphql', graphql(graphqlConfig));
};

Feathersjs Service-Level Protection

Combine introspection protection with Feathersjs's built-in authentication and authorization. Modify your service setup to include GraphQL security:

const { authenticate } = require('@feathersjs/authentication');
const { graphql } = require('@feathersjs/graphql');
const { schema } = require('./schema');

module.exports = app => {
  const graphqlConfig = {
    schema,
    introspection: process.env.NODE_ENV === 'development'
  };

  const graphqlService = graphql(graphqlConfig);
  
  // Apply authentication to GraphQL endpoint
  app.use('/graphql', authenticate('jwt'), graphqlService);
};

Custom Introspection Handler

For advanced scenarios, implement a custom introspection handler that returns limited information:

const { graphql } = require('@feathersjs/graphql');
const { schema } = require('./schema');

async function introspectionHandler(request, response) {
  if (process.env.NODE_ENV === 'production') {
    return response.status(403).json({
      error: 'Introspection disabled in production'
    });
  }
  
  // Allow introspection in development
  return graphql({ schema })(request, response);
}

module.exports = app => {
  app.use('/graphql', (req, res, next) => {
    if (req.method === 'POST' && req.body && req.body.query) {
      const firstLine = req.body.query.split('\n')[0];
      if (firstLine.includes('__schema') || firstLine.includes('__type')) {
        return introspectionHandler(req, res);
      }
    }
    return graphql({ schema })(req, res);
  });
};

Monitoring and Logging

Add monitoring to detect introspection abuse attempts:

const { graphql } = require('@feathersjs/graphql');
const { schema } = require('./schema');
const logger = require('./logger');

module.exports = app => {
  app.use('/graphql', (req, res, next) => {
    if (req.body && req.body.query) {
      if (req.body.query.includes('__schema') || req.body.query.includes('__type')) {
        logger.warn('Introspection query detected', {
          ip: req.ip,
          userAgent: req.get('User-Agent'),
          timestamp: new Date().toISOString()
        });
      }
    }
    return graphql({ schema })(req, res);
  });
};