[go: up one dir, main page]
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support for estimating and limiting max allowed query cost #40

Closed
rafalp opened this issue Oct 17, 2018 · 4 comments
Closed

Add support for estimating and limiting max allowed query cost #40

rafalp opened this issue Oct 17, 2018 · 4 comments
Assignees
@patrys
Labels
roadmap Feature that we want to have included

Comments

@rafalp
Copy link
Contributor
rafalp commented Oct 17, 2018

This is the white whale of GraphQL server implementation - the way to detect maliciously constructed queries and reject their execution before even touching the data.

We haven't moved on to implementing anything yet, but current idea for achieving this is creating copy of "real" schema, but replacing all scalars with Int. We could then re-use the existing query execution logic to get data structure containing the price of each individual field in the result. One of potential issues I'm seeing here would be counting fields returning types.

The alternative approach would involve implementing custom query executor which would traverse the fields defined in query, keeping track of its position, depth, and counting the score on the fly. It may be that this approach may not be as scary as it appears, due to us not needing to implement entire execution flow - just walk the fields in query.
@rafalp rafalp added the roadmap Feature that we want to have included label Oct 17, 2018
@ajhyndman
Copy link
Contributor
ajhyndman commented Mar 29, 2019 •
edited
Loading

For what it's worth, I think supporting "persisted queries" (a form of query whitelisting) is a simple, robust alternative that satisfies a large proportion of non-public-facing needs.

https://github.com/apollographql/persistgraphql#server-side

I think making that easy to support in Ariadne would go a long way.

@patrys
Copy link
Contributor
patrys commented Mar 29, 2019

@ajhyndman We already have a working query cost limiter, it's a matter of incorporating it into Ariadne.

@ajhyndman
Copy link
Contributor

Wow, cool!

@iamareebjamal iamareebjamal mentioned this issue Dec 5, 2019
Closed
@rafalp
Copy link
Contributor Author
rafalp commented Mar 1, 2021

This feature is already available in ariadne via ariadne.validation.cost_validator.

@rafalp rafalp closed this as completed Mar 1, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@patrys patrys

Labels
roadmap Feature that we want to have included
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@patrys @rafalp @ajhyndman