hasura / hasura/graphql-engine

Realtime Data Source DoS Mitigation and Prevention

Open
#9,518 0 comments 0 reactions 0 assignees View on GitHub
k/enhancement
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

### Problem

Given the powerful and flexible nature of the GraphQL APIs that Hasura provides, sometimes developers accidentally write queries that can take a long time to execute on the underlying data source. For example, it's easy to write a query that has a "where" clause on an unindexed field of a table with millions of rows. A large number of such queries at the same time can render the data source unavailable.

### Solution

Hasura should provide a way of detecting, mitigating and preventing such queries in realtime for SREs and sysadmins to ensure continued availability of the service.

Ideally, Hasura should:
- Intelligently detect problematic queries
- Alert SREs if these queries reach a critical level and database performance starts suffering
- Allow SREs to manually cancel and block such queries
- Automatically limit such queries before they become a problem and notify SREs
- Provide automatic feedback to the developer when problematic queries are issued

As a first step, Hasura can
- Capture Prometheus metrics for different query structures (and not just operation names)
- Add the ability to view query structures with outlier metrics in the Hasura console
- Add the ability to easily cancel and block certain query structures from the console (or metadata)

Contributor guide

Open the contributing guide

Research direction

The issue names no files, tests, or entry points. Start by scoping the first-step work around query-structure Prometheus metrics, console visibility, and cancellation or blocking through the console or metadata. Done means these capabilities are specified and implemented with feedback or alerts for problematic queries.

Written by the indexing model from the issue text.

Assessment

Tech stack
graphql, prometheus
Domain
backend-api-design, databases, observability
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.