GraphQL deployed to production reveals hints to other types when one not found #4275
Description
Given the following SDL:
export const schema = gql`
type Account {
id: String!
address: String!
createdAt: DateTime!
}
input CreateAccountInput {
address: String!
}
type Mutation {
account(input: CreateAccountInput!): Account @requireAuth
}
`
If you make a mutation request for a type that does not exist (there is no createAccount type):
mutation CreateAccountMutation($input: String!) {
createAccount(input: $input) {
id
}
}
The response contains suggestions for other endpoints which do exist:
{
"errors": [
{
"message": "Cannot query field \"createAccount\" on type \"Mutation\". Did you mean \"account\"?",
"locations": [
{
"line": 2,
"column": 3
}
]
}
]
}
This response is great in development. But, since we disable introspection in production to be default-secure, this feels like a security risk as it gives away other endpoints to start probing.