Spectrum: /api is exposed (GraphQL playground)

[atlx]

Issue Type

• [X] Bug Report

https://spectrum.chat/api exposes a GraphQL playground. I'm pretty sure that's not intended.

[mxstbr]

You're right, we should be disabling that! We disable introspection, so there isn't really much you can do with it though.

[dev-drprasad]

@mxstbr is it still issue ?? can i pick it ??

[mxstbr]

Yes please do @dev-drprasad! :pray:

[dev-drprasad]

@mxstbr what about completely disabling playground ?
something like:

  playground: process.env.NODE_ENV !== 'production' && {
    settings: {
      'editor.theme': 'light',
    },
    tabs: [
      {
        endpoint: 'http://localhost:3001/api',
        query: `{
  user(username: "mxstbr") {
    id
    username
  }
}`,
      },
    ],
  },
  introspection: process.env.NODE_ENV !== 'production',

introspection is disabled by default in production but i added condition for sanity.

Ref: https://www.apollographql.com/docs/apollo-server/features/graphql-playground.html

[mxstbr]

Yes sounds great!