5 ms·
Point 1, exposing a potential denial of service attack via expensive queries, was always a point of contention I had with GraphQL. I'd love to explore using Gra
by ashleyn 5y ago
Point 1, exposing a potential denial of service attack via expensive queries, was always a point of contention I had with GraphQL. I'd love to explore using GraphQL in a project but security is typically a high priority. What is the generally accepted way of preventing denial of service attacks using oversized GraphQL queries?
- acidbaseextract 5y agoFTA, though the misspellings are frustrating: In a GraphQL API, tools such as Dataloader allow you to batch and cache database calls. But in some cases, even this [isn't] enough and the only solution is to block queries by calculating a maximum execution cost or query [depth]. And any of these solutions will depend on the library you’re using.
- michaelghayes 5y agoone popular option is to have a query whitelist, with arbitrary queries allowed either through special permissions, or just in development. setting up CI steps to auto-publish any queries used by your apps is usually pretty straight forward. this obviously only works for non-public APIs. Another common patter is to have a way to calculate query complexity, where each field had some cost, and some multiplier for list fields so you can calculate an approximate complexity before executing a query