GraphQL Federation

GraphQL federation gateway with SDL trust boundary, sub-graph health, subgraph SDL signing, query plan caps.

Apollo Federation subgraphs expose the schema via the _service { sdl } query and _entities resolver — independent of the introspection toggle. Operators who disable introspection in production still leak the full SDL through these federation probes. The guard refuses such queries unless they carry a shared-secret router token (timing-safe-compared, 32-char minimum), with optional nonce-store replay protection so a captured router token can't be replayed across requests.

b.graphqlFederation.queryProbesSdl(query) #

Cheap textual probe — does the GraphQL query reference _service or _entities? Returns true for anything that matches the federation-SDL detector after a 64 KiB length bound, false otherwise. Used by guardSdl to skip the auth gate for non- federation queries; operator-callable so a custom middleware can apply the same gate to a non-HTTP transport (queue worker, RPC).

b.graphqlFederation.queryProbesSdl("query { _service { sdl } }");
// → true

b.graphqlFederation.queryProbesSdl("query { user(id: 1) { name } }");
// → false

b.graphqlFederation.guardSdl(opts) #

{
  publicSchemaOk:   boolean,                                       // default false — explicit override to publish the SDL
  routerToken:      string,                                        // required unless publicSchemaOk; 32+ chars
  nonceStore:       { checkAndInsert(nonce, expireAt): bool },     // optional atomic replay protection (b.nonceStore-shaped)
  nonceHeader:      string,                                        // default "x-apollographql-router-nonce" — request header carrying the replay nonce
  nonceTtlMs:       number,                                        // default 5 minutes
  errorClass:       Function,                                      // default GraphqlFederationError
  audit:            boolean,                                       // default true
}

Build the federation-SDL trust-boundary middleware. Reads the GraphQL query from the JSON body (capped at 1 MiB), passes non-federation queries straight through, and refuses _service { sdl } / _entities queries with HTTP 401 unless the request carries a Bearer (timing-safe compare, 32-char minimum) — or publicSchemaOk:true is explicitly set. Optional nonceStore keyed off x-apollographql-router-nonce blocks replay of a captured token across requests; default TTL is 5 minutes. Returns a (req, res, next) middleware function.

var guard = b.graphqlFederation.guardSdl({
  routerToken: "router-shared-secret-thirty-two-chars",
});
typeof guard;
// → "function"

Last updated 2026-08-08T16:39:49.652Z by seeder.