API Design · Senior · Question 24 of 75
Why might introspection be disabled for a public GraphQL API in production?
- ✓Correct answer: It reveals the whole schema to anyone; with persisted queries or private APIs, there's little reason to expose it
- 2GraphQL clients don't support it
- 3Introspection makes every query slower
Explanation
It's not real security, since schemas can be inferred, but it reduces easy reconnaissance.