hasura / hasura/graphql-engine
Realtime Data Source DoS Mitigation and Prevention
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
### Problem
Given the powerful and flexible nature of the GraphQL APIs that Hasura provides, sometimes developers accidentally write queries that can take a long time to execute on the underlying data source. For example, it's easy to write a query that has a "where" clause on an unindexed field of a table with millions of rows. A large number of such queries at the same time can render the data source unavailable.
### Solution
Hasura should provide a way of detecting, mitigating and preventing such queries in realtime for SREs and sysadmins to ensure continued availability of the service.
Ideally, Hasura should:
- Intelligently detect problematic queries
- Alert SREs if these queries reach a critical level and database performance starts suffering
- Allow SREs to manually cancel and block such queries
- Automatically limit such queries before they become a problem and notify SREs
- Provide automatic feedback to the developer when problematic queries are issued
As a first step, Hasura can
- Capture Prometheus metrics for different query structures (and not just operation names)
- Add the ability to view query structures with outlier metrics in the Hasura console
- Add the ability to easily cancel and block certain query structures from the console (or metadata)
Contributor guide
Research direction
The issue names no files, tests, or entry points. Start by scoping the first-step work around query-structure Prometheus metrics, console visibility, and cancellation or blocking through the console or metadata. Done means these capabilities are specified and implemented with feedback or alerts for problematic queries.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- graphql, prometheus
- Domain
- backend-api-design, databases, observability
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 20/100