Secure GraphQL introspection and schema stitching?

Disable introspection in production via GraphQLModule.forRoot({ introspection: process.env.NODE_ENV !== 'production' }) to prevent schema discovery by attackers.

Rate-limit complex queries using @nestjs/throttler or Apollo's complexity plugin; limit query depth with graphql-depth-limit. For schema stitching/federation, validate subgraphs with Apollo Router; use persisted queries only. Enable field-level auth guards and verbose error suppression.

Example:-

Code

// app.module.ts
GraphQLModule.forRoot({
  autoSchemaFile: 'schema.gql',
  playground: false,
  introspection: process.env.NODE_ENV !== 'production',
  validationRules: [depthLimit(10)],  // Query depth max 10
});