How to Redact Internal Directives, Bearer JWTs, and PII Variables from GraphQL Schemas & Query Logs in Local Browser RAM

Описание и применение

Инструмент GraphQL Schema & Query Token Redactor удаляет из GraphQL‑артефактов внутренние директивы, JWT‑токены, админ‑секреты и PII, сохраняя структуру схемы и работая полностью в браузере.

Задача

Exported GraphQL artifacts (SDL, introspection JSON, operation variables) can leak internal directives, admin headers, session JWTs, plaintext PII, and expose the API blueprint to third parties.

Результат

The tool removes internal directives, JWTs, admin secrets, and PII from GraphQL artifacts while maintaining schema structure, enabling safe sharing of sanitized data.

Рабочий процесс

• Export .graphql SDL files, __schema introspection JSON, or operation variables dumps.
• Paste or upload the artifacts into the GraphQL Schema & Query Token Redactor sandbox in the browser.
• Select desired redaction depth (35%, 70%, or 95%).
• Review the sanitized output in the browser.
• Copy or download the sanitized payload (free 70% plaintext export).
• If needed, use the standalone offline HTML5 workstation for large batch sanitization.

Доказательства

Engineers regularly export .graphql Schema Definition Language (SDL) files, __schema introspection JSON payloads, and operation variables dumps.

Источник

Internal RBAC & Federation Directives: Custom directives like @auth(role: ADMIN), @internal(upstream: "http://10.24.8.19:8080"), or federation @link URLs expose your internal microservice topology.

Источник

Admin Headers & Session JWTs: Exported GraphQL trace logs often retain Authorization: Bearer <JWT>, x-hasura-admin-secret, or session cookies.

Источник

Plaintext PII in Operation Variables: A failed CreatePaymentIntent or UpdateCustomerProfile mutation dump almost always carries real customer emails, billing addresses, card tokens, or SSNs inside the variables JSON object.

Источник

To solve this without requiring a $49/seat/month cloud workspace, we built GraphQL Schema & Query Token Redactor (073-graphql-schema-inspector), which executes 100% inside local browser RAM.

Источник

3-Tier Redaction Depth Slider (35% / 70% / 95%)

Источник