UserRegisterMutator.java

@Component
public class UserRegisterMutator {

	public static final String REGISTER_ARGUMENT_NAME = "userRegisterRequest";
  
	/**
	 * @param userRegisterRequest Contains info about the user's registration, e.g. their name
	 * 
	 * @return Always returns true, so potential attackers get no info. Valid attempts will get an email.
	 */
	@GraphQLMutation(name = "userRegister")
	@PreAuthorize("permitAll()")
	public boolean userRegister(@GraphQLArgument(
			name = REGISTER_ARGUMENT_NAME) @GraphQLNonNull final UserRegisterRequest userRegisterRequest) {
    
		// user registration stuff
		// ...
    
		// always return true, otherwise attacks can work out the emails of users who have already registered
		return true;
	}
}