Disable GraphQL schema introspection in Elixir Absinthe using a plugin

authorized_introspection.ex

# MIT License
#
# Copyright (c) 2025 Ahmad Hammad / @afhammad
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in
# all copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
# SOFTWARE

defmodule MyAppWeb.Schema.Middleware.AuthorizedIntrospection do
  @moduledoc """
  Disable or restrict schema introspection to authorized requests
  """
  @behaviour Absinthe.Plugin

  @impl Absinthe.Plugin
  def before_resolution(%{context: %{admin: true}} = exec), do: exec

  def before_resolution(exec) do
    if Enum.find(exec.result.emitter.selections, fn %{name: field_name} ->
         Macro.underscore(field_name) == "__schema"
       end) do
      %{
        exec
        | validation_errors: [
            %Absinthe.Phase.Error{message: "Unauthorized", phase: __MODULE__}
          ]
      }
    else
      exec
    end
  end

  @impl Absinthe.Plugin
  def after_resolution(exec), do: exec

  @impl Absinthe.Plugin
  def pipeline(pipeline, _exec), do: pipeline
end

authorized_introspection_test.exs

defmodule MyAppWeb.Schema.Fixtures.TestSchema do
  use Absinthe.Schema

  query do
    field(:test, :integer, resolve: fn _, _ -> {:ok, 1} end)
  end

  def plugins do
    [MyAppWeb.Schema.Middleware.AuthorizedIntrospection | Absinthe.Plugin.defaults()]
  end
end

defmodule MyAppWeb.Schema.Middleware.AuthorizedIntrospectionTest do
  use ExUnit.Case, async: true

  @schema MyAppWeb.Schema.Fixtures.TestSchema

  @query """
  query {
    test
  }
  """

  @schema_query """
  query {
    test
    __schema {
      types {
        name
      }
    }
  }
  """

  @schema_query_alt_case """
  query {
    test
    _Schema {
      types {
        name
      }
    }
  }
  """

  describe "allow query without introspection" do
    test "returns data" do
      assert {:ok, %{data: %{"test" => 1}}} =
               Absinthe.run(@query, @schema, context: %{admin: false})
    end
  end

  describe "prevent unauthorized introspection" do
    test "returns unauthorized and no data" do
      assert {:ok, %{errors: [%{message: "Unauthorized"}]}} ==
               Absinthe.run(@schema_query, @schema, context: %{admin: false})
    end

    test "alt case, returns unauthorized and no data" do
      assert {:ok, %{errors: [%{message: "Unauthorized"}]}} ==
               Absinthe.run(@schema_query_alt_case, @schema, context: %{admin: false})
    end
  end

  describe "allow authorized introspection" do
    test "returns data and schema" do
      assert {:ok, %{data: %{"test" => 1, "__schema" => _}}} =
               Absinthe.run(@schema_query, @schema, context: %{admin: true})
    end
  end
end

Here is another solution

defmodule DisableIntrospection do
  alias Absinthe.{Phase, Pipeline}

  def pipeline(pipeline) do
    pipeline
    |> Pipeline.without(Phase.Schema.Introspection)
  end
end

and then in your schema add @pipeline_modifier DisableIntrospection
unfortunately this doesn't get rid of suggestions, which are really aggressive in AbsInThe and could be used to dump the entire schema fairly easily.

@afhammad This is a life saver. Thank you!

What is this code licensed as? If you choose a license, could you upload it to the gist? I would personally like it to be MIT licensed for easy copy/paste, but obviously you can choose what you want :)

@afhammad This is a life saver. Thank you!

What is this code licensed as? If you choose a license, could you upload it to the gist? I would personally like it to be MIT licensed for easy copy/paste, but obviously you can choose what you want :)

@andrewrowe-wk I added MIT license, feel free to copy!

@afhammad This is a life saver. Thank you!
What is this code licensed as? If you choose a license, could you upload it to the gist? I would personally like it to be MIT licensed for easy copy/paste, but obviously you can choose what you want :)

@andrewrowe-wk I added MIT license, feel free to copy!

Thank you! This is fantastic!

Just a quick follow up question...

Looking at the revisions, I am having a hard time determining the motivation for moving from String.downcase to Macro.underscorein the before_resolution function. Is there some specific edge case that counts for? I see that it converts things like _Schema to __schema, but I wasn't able to find anything in GQL spec about using capital letters for reserved words.