fix: remove security vulnerability of exposing graph in production environment

[sahanatroam]

Resolves and related to:
#3229
#2247

Following Node.js best practices of setting NODE_ENV=production we could use the same pattern to disable this security vulnerability in graphql-js at the core.

Open for feedback to resolve this issue ASAP

[linux-foundation-easycla]

The committers are authorized under a signed CLA.

• ✅ sahan (f0bc04e)

[saihaj]

This is a node specific fix. As suggested in that issue i think it would be better to have a Boolean configuration.

[sahanatroam]

@saihaj Thanks for the review, I wonder if by default the library should enforce good practices so that we do not leave vulnerable code in production systems?

[saihaj]

Yes but this isn’t a platform agnostic fix. This library can be used in non-node environments. So it is something in the environment you are implementing that this can be handled.

[sahanatroam]

Understood. Keen to see how this progress and I could help with the fix: #2247 (comment)

[IvanGoncharov]

It shouldn't be a dev vs production configuration.
Production servers can support both introspection and didYouMean (e.g. public APIs, or anyone who does not follow the "security through obscurity" approach).

Having global flags (though env or something else) is also bad since it leads to very non-intuitive behavior (e.g. if calls some function in web worker it will behave differently).

I want to keep #2247 as the single discussion for discussing solutions so closing this one.
I will explore some ideas I have next work week and write my findings in #2247