DisableIntrospection

The DisableIntrospection extension disables standard GraphQL introspection queries for the schema. It blocks fields such as __schema and __type.

This can be useful to prevent clients from discovering unreleased or internal features of the API through GraphQL introspection.

DisableIntrospection does not block non-introspection fields that may expose schema information. For example, Apollo Federation schemas expose _service and its sdl field so gateways and routers can compose federated services. If you use strawberry.federation.Schema, protect federated endpoints from untrusted clients with your own authentication, authorization, or network controls.

Usage example:

import strawberry
from strawberry.extensions import DisableIntrospection


@strawberry.type
class Query:
    @strawberry.field
    def hello(self) -> str:
        return "Hello, world!"


schema = strawberry.Schema(
    Query,
    extensions=[
        DisableIntrospection(),
    ],
)

API reference:

No arguments

Example query:

Running any query including the introspection field __schema will result in an error. Consider the following query, for example:

query {
  __schema {
    __typename
  }
}

Running it against the schema with the DisableIntrospection extension enabled will result in an error response indicating that introspection has been disabled:

{
  "data": null,
  "errors": [
    {
      "message": "GraphQL introspection has been disabled, but the requested query contained the field '__schema'.",
      "locations": [
        {
          "line": 2,
          "column": 3
        }
      ]
    }
  ]
}