Express middleware to expose an endpoint for the GraphQL Playground IDE SECURITY NOTE: All versions of
1.7.16or later have a security vulnerability when unsanitized user input is used while invoking
expressPlayground(). Read more below
yarn add graphql-playground-middleware-express
npm install graphql-playground-middleware-express --save
See full example in examples/basic.
const express =const expressPlayground =defaultconst app =app
All versions before
1.7.16 were vulnerable to user-defined input to
expressPlayground(). Read more in the security notes
Security Upgrade Steps
To fix the issue, you can upgrade to
1.6.12 or later. If you aren't able to upgrade, see the security notes for a workaround.
yarn add graphql-playground-express@^1.7.16
npm install --save graphql-playground-express@^1.7.16