Skip to main content

Block field suggestions

Prevent returning field suggestions and leaking your schema to unauthorized actors.

In production, this can lead to Schema leak even if the introspection is disabled.

Configuring for GraphQL Armor​

GraphQLArmorConfig({
  blockFieldSuggestion: {
    // Toogle the plugin | default: true
    enabled?: boolean,
    
    // Mask applied to the error message | default: '[Suggestion hidden]'
    mask?: string,
  }
})

Standalone usage​

Installation​

note

If you want to use the blockFieldSuggestion plugin out of GraphQL Armor, you can install it from npm:

# npm
npm install @escape.tech/graphql-armor-block-field-suggestions

# yarn
yarn add @escape.tech/graphql-armor-block-field-suggestions

With @envelop/core from @the-guild-org​

Using the default mask​

import { envelop } from '@envelop/core';
import { blockFieldSuggestionsPlugin } from '@escape.tech/graphql-armor-block-field-suggestions';

const getEnveloped = envelop({
  plugins: [
    // ... other plugins ...
    blockFieldSuggestionsPlugin(),
  ]
});

Using custom mask​

import { envelop } from '@envelop/core';
import { blockFieldSuggestionsPlugin } from '@escape.tech/graphql-armor-block-field-suggestions';

const getEnveloped = envelop({
  plugins: [
    // ... other plugins ...
    blockFieldSuggestionsPlugin({
        mask: '<[REDACTED]>'
    }),
  ]
});