<labelid="sidebar-toggle"class="icon-button"for="sidebar-toggle-anchor"title="Toggle Table of Contents"aria-label="Toggle Table of Contents"aria-controls="sidebar">
<ahref="../print.html"title="Print this book"aria-label="Print this book">
<iid="print-button"class="fa fa-print"></i>
</a>
</div>
</div>
<divid="search-wrapper"class="hidden">
<formid="searchbar-outer"class="searchbar-outer">
<inputtype="search"id="searchbar"name="searchbar"placeholder="Search this book ..."aria-controls="searchresults-outer"aria-describedby="searchresults-header">
<p>The <ahref="https://spec.graphql.org/October2021#sec-Schema-Introspection">schema introspection</a> system is accessible from the meta-fields <code>__schema</code> and <code>__type</code> which are accessible from the type of the root of a query operation.</p>
<p>Like all meta-fields, these are implicit and do not appear in the fields list in the root type of the query operation.</p>
</blockquote>
<p><ahref="https://graphql.org">GraphQL</a> provides <ahref="https://spec.graphql.org/October2021#sec-Introspection">introspection</a>, allowing to see what <ahref="https://spec.graphql.org/October2021#sel-GAFRJBABABF_jB">queries</a>, <ahref="https://spec.graphql.org/October2021#sel-GAFRJDABABI5C">mutations</a> and <ahref="https://spec.graphql.org/October2021#sel-GAFRJFABABMvpN">subscriptions</a> a <ahref="https://graphql.org">GraphQL</a> server supports at runtime.</p>
<p>Because <ahref="https://spec.graphql.org/October2021#sec-Introspection">introspection</a> queries are just regular <ahref="https://spec.graphql.org/October2021#sel-GAFRJBABABF_jB">GraphQL queries</a>, <ahref="https://docs.rs/juniper">Juniper</a> supports them natively. For example, to get all the names of the types supported, we could <ahref="https://spec.graphql.org/October2021#sec-Execution">execute</a> the following <ahref="https://spec.graphql.org/October2021#sel-GAFRJBABABF_jB">query</a> against <ahref="https://docs.rs/juniper">Juniper</a>:</p>
<p>Disabling introspection in production is a widely debated topic, but we believe it’s one of the first things you can do to harden your GraphQL API in production.</p>
<p><ahref="https://www.apollographql.com/blog/why-you-should-disable-graphql-introspection-in-production">Some security requirements and considerations</a> may mandate to disable <ahref="https://spec.graphql.org/October2021#sec-Schema-Introspection">GraphQL schema introspection</a> in production environments. In <ahref="https://docs.rs/juniper">Juniper</a> this can be achieved by using the <ahref="https://docs.rs/juniper/0.16.1/juniper/struct.RootNode.html#method.disable_introspection"><code>RootNode::disable_introspection()</code></a> method:</p>
type Schema = RootNode<'static, Query, EmptyMutation, EmptySubscription>;
fn main() {
let schema = Schema::new(Query, EmptyMutation::new(), EmptySubscription::new())
.disable_introspection();
let query = "query { __schema { queryType { name } } }";
match juniper::execute_sync(query, None, &schema, &graphql_vars! {}, &()) {
Err(GraphQLError::ValidationError(errs)) => {
assert_eq!(
errs.first().unwrap().message(),
"GraphQL introspection is not allowed, but the operation contained `__schema`",
);
}
res => panic!("expected `ValidationError`, returned: {res:#?}"),
}
}</code></pre></pre>
<blockquote>
<p><strong>NOTE</strong>: Attempt to execute an <ahref="https://spec.graphql.org/October2021#sec-Schema-Introspection">introspection query</a> results in <ahref="https://spec.graphql.org/October2021#sec-Validation">validation</a> error, rather than <ahref="https://spec.graphql.org/October2021#sec-Execution">execution</a> error.</p>
