Hacker News Reader

Point 1, exposing a potential denial of service attack via expensive queries, was always a point of contention I had with GraphQL. I'd love to explore using GraphQL in a project but security is typically a high priority. What is the generally accepted way of preventing denial of service attacks using oversized GraphQL queries?

View on HN

one popular option is to have a query whitelist, with arbitrary queries allowed either through special permissions, or just in development. setting up CI steps to auto-publish any queries used by your apps is usually pretty straight forward. this obviously only works for non-public APIs.

Another common patter is to have a way to calculate query complexity, where each field had some cost, and some multiplier for list fields so you can calculate an approximate complexity before executing a query

FTA, though the misspellings are frustrating:

In a GraphQL API, tools such as Dataloader allow you to batch and cache database calls. But in some cases, even this [isn't] enough and the only solution is to block queries by calculating a maximum execution cost or query [depth]. And any of these solutions will depend on the library you’re using.

Reply on news.ycombinator.com