graphql-playground-middleware-express

Express middleware to expose an endpoint for the GraphQL Playground IDE SECURITY NOTE: All versions of graphql-playground-express until 1.7.16 or later have a security vulnerability when unsanitized user input is used while invoking expressPlayground(). Read more below

Installation

Using yarn:

yarn add graphql-playground-middleware-express

Or npm:

npm install graphql-playground-middleware-express --save

Usage

See full example in examples/basic.

const express = require('express')
const expressPlayground = require('graphql-playground-middleware-express')
  .default

const app = express()

app.get('/playground', expressPlayground({ endpoint: '/graphql' }))

Security Notes

All versions before 1.7.16 were vulnerable to user-defined input to expressPlayground(). Read more in the security notes

Security Upgrade Steps

To fix the issue, you can upgrade to 1.6.12 or later. If you aren't able to upgrade, see the security notes for a workaround.

yarn: yarn add graphql-playground-express@^1.7.16

npm: npm install --save graphql-playground-express@^1.7.16

Change Log

All notable changes to this project will be documented in this file. See Conventional Commits for commit guidelines.

1.7.23 (2021-11-04)

Note: Version bump only for package graphql-playground-middleware-express

1.7.22 (2020-10-20)

Note: Version bump only for package graphql-playground-middleware-express

1.7.21 (2020-09-15)

Note: Version bump only for package graphql-playground-middleware-express

1.7.20 (2020-08-30)

Note: Version bump only for package graphql-playground-middleware-express

1.7.19 (2020-08-30)

Note: Version bump only for package graphql-playground-middleware-express

1.7.15 (2020-06-07)

Bug Fixes

• hide config element 😆 (#1224) (a7bdcaa)
• rectify all versions and references (#1223) (239289b)
• deps: update deps and toolchain, move back to using yarn… (#1191) (824c7a5)
• deps: Update express mw to latest graphql-playground-html (#984) (0bc65e8)

1.8.10 (2019-02-23)

1.8.9 (2019-02-01)

1.8.7 (2019-01-28)

Bug Fixes

• graphql 14: version bump via graphql-config (#861) (5ea711c)

1.6.2 (2018-07-06)

1.6.1 (2018-06-26)

1.5.9 (2018-05-25)

1.5.8 (2018-05-10)

1.4.0 (2018-01-15)

Bug Fixes

• deps: make graphql-config a normal dep (9e4d93e)
• deps: Remove extension dependencies (72ce36c), closes #493
• subscriptions: fixed subscriptions url normalization (f675517)

1.3.23 (2018-01-08)

Bug Fixes

• deps: Update graphql-playground-middleware-express (0ac03f3)

1.3.22 (2018-01-05)

1.3.12 (2017-12-24)

1.3.11 (2017-12-24)

1.3.9 (2017-12-14)

1.3.6 (2017-12-04)

1.3.5 (2017-12-04)

Features

• middleware: draft animated loading screen (c082c07)

1.3.0 (2017-12-01)

1.2.0 (2017-11-24)

Bug Fixes

• fix example (714d571)

Features

• sparate express into its own package (8e250d4)