The limitation of /graphql/schema

[dugenkui03]

User still can get all the detail about the definition of schema by IntrospectionQuery, and not only ‘Type’ definition but also directive definition.

/graphql/schema seems to be redundant, or IntrospectionQuery also need to be limited as well.

[bclozel]

Enabling/disabling the schema endpoint is not about security, but convenience. In that sense, I don't think we necessarily need to align schema introspection and schema exposure in text format.

People might still want to easily disable introspection, so I've created spring-projects/spring-boot#29248 since the auto-configuration has now moved to the Spring Boot project.

In the meantime, you should be able to achieve just that with the following:

@Bean
public RuntimeWiringConfigurer disableFieldInstrospectionWiringConfigurer() {
	return builder -> builder.fieldVisibility(NoIntrospectionGraphqlFieldVisibility.NO_INTROSPECTION_FIELD_VISIBILITY);
}

I'm closing this issue as it's superseded by the Spring Boot one.