Skip to main content
2026-07-29 16:01
gRPC

gRPC Reflection

QueryValidateExpert
Try Interactive Demo

What you will learn

  • Reflection exposes service schema — useful for generic clients (grpcurl), dangerous for public APIs (enumeration)
  • Test that reflection is disabled or gated on prod — grpcurl ls against prod should 401/403 or return nothing
  • Field masks + reflection together enable 'introspect schema, select fields' — powerful but widens the attack surface

Description

Use server reflection to discover services and methods at runtime.

Test Scenario

// List all services
grpcurl -plaintext localhost:50051 list

// Output:
grpc.reflection.v1alpha.ServerReflection
practice.orders.OrderService
practice.products.ProductService
practice.users.UserService

// Describe a service
grpcurl -plaintext localhost:50051 describe practice.users.UserService

// Output:
practice.users.UserService is a service:
service UserService {
  rpc CreateUser ( .practice.users.CreateUserRequest ) ...
  rpc GetUser ( .practice.users.GetUserRequest ) ...
}

Testing Tips

  • •Reflection enables dynamic discovery
  • •grpcurl uses it to work without proto files
  • •Useful for debugging and tooling
// Playwright API Testing - gRPC (via REST gateway)
import { test, expect } from '@playwright/test';


test('gRPC unary call via gateway', async ({ request }) => {
  const response = await request.post('/api/grpc/UserService/GetUser', {
    data: { id: '1' }
  });


  expect(response.ok()).toBeTruthy();
  const data = await response.json();
  expect(data.user).toBeDefined();
});

Challenge ID: grpc-reflection

2 frameworks available