Clojurians Log v2

Anyone have any opinions on disabling introspection so malicious actors can't view the entire GraphQL schema you've defined?

Have an app that runs off of a graphql backend, but we've found that anyone can go in and expose the schema. There's nothing dangerous there but it exposes a lot of information we'd rather not share.

I don't think there's any provision in Lacinia for that.

I would consider adding an option to disable introspection; you might disable introspection in production, but not in QA/staging. But no introspection ➠ no GraphIQL.

Oh interesting, that's what we were discussing doing, removing introspection from QA/staging but leaving it in dev. I read that GraphiQL relies heavily on introspection and won't work without it.

I have to figure out now how to go about disabling it in Lacinia.

Does lacinia take PRs for that sort of thing?