sillsdev / sillsdev/languageforge-lexbox

Enforce GQL cost limits

Open
#1,179 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

📦 Lexbox
Dominant language
C#
Stars
9
Forks
8
Avg merge
2d 13h
Merged PRs (30d)
49

Description

Describe the feature
Hot chocolate 14 enforces cost limits by default.
Some of our queries exceed these limits (only in theory) and would require some rewriting. So, I've opted to disable the new limit enforcement for now.

Note: an alternative (sort of) to cost enforcement is using "persisted operations", which means our GQL server only serves requests for the queries we've explicitly told it to support (e.g. all the ones our UI uses). I.e. it sort of becomes a REST server in prod. According to the link above that's what Facebook did.

Who is this feature for?
This is a security feature that prevents large queries from taking down our server.

Pages affected
Currently our admin page exceeds the limits. There might be more.

The reason it exceeds the limit is, because we pass in project and user filters as a variable. The filters could potentially be absolutely massive, because there are a ton of fields that you could apply a ton of filter operations on. Because we pass the filters in as variables, Hot Chocolate just assumes the maximum possible cost.

I'm not sure what the most elegant way to solve this is.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the linked Hot Chocolate 14 cost-limit guidance and inspect the admin page's GraphQL queries and the server configuration that disables enforcement. Determine why variable-based project and user filters receive maximum cost, then establish whether bounded filters, query rewriting, or persisted operations best meets the security goal. Done means relevant queries work with cost enforcement enabled without permitting excessive server work.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp, graphql
Domain
api, backend-api-design, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.