GraphQL introspection disabled in production

GraphQL introspection exposes your complete API schema — every type, field, mutation, and query — to anyone who can reach the endpoint. OWASP API Security Top 10 2023 API8 (Security Misconfiguration) and CWE-200 (Exposure of Sensitive Information) both flag introspection as an information disclosure risk. Attackers use introspection to map internal data models, identify admin mutations, discover deprecated endpoints, and understand field naming conventions before crafting targeted queries. In a production API, the schema is sensitive internal documentation. Development environments may leave introspection on by default; that default should be explicitly disabled when deploying to production.

Disable introspection in production by gating it on NODE_ENV. If schema exploration is needed for internal teams, restrict it behind authentication rather than removing it entirely.

// Apollo Server v4
import { ApolloServer } from '@apollo/server'

const server = new ApolloServer({
  schema,
  introspection: process.env.NODE_ENV !== 'production',
  // Also disable the Explorer landing page in production
  plugins: process.env.NODE_ENV === 'production'
    ? [ApolloServerPluginLandingPageDisabled()]
    : [ApolloServerPluginLandingPageLocalDefault()]
})

For authenticated introspection, add a validation rule that checks context.user?.role === 'admin' before permitting __schema queries.