sillsdev / sillsdev/languageforge-lexbox
Enforce GQL cost limits
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 9
- Forks
- 8
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 49
Description
Describe the feature
Hot chocolate 14 enforces cost limits by default.
Some of our queries exceed these limits (only in theory) and would require some rewriting. So, I've opted to disable the new limit enforcement for now.
Note: an alternative (sort of) to cost enforcement is using "persisted operations", which means our GQL server only serves requests for the queries we've explicitly told it to support (e.g. all the ones our UI uses). I.e. it sort of becomes a REST server in prod. According to the link above that's what Facebook did.
Who is this feature for?
This is a security feature that prevents large queries from taking down our server.
Pages affected
Currently our admin page exceeds the limits. There might be more.
The reason it exceeds the limit is, because we pass in project and user filters as a variable. The filters could potentially be absolutely massive, because there are a ton of fields that you could apply a ton of filter operations on. Because we pass the filters in as variables, Hot Chocolate just assumes the maximum possible cost.
I'm not sure what the most elegant way to solve this is.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked Hot Chocolate 14 cost-limit guidance and inspect the admin page's GraphQL queries and the server configuration that disables enforcement. Determine why variable-based project and user filters receive maximum cost, then establish whether bounded filters, query rewriting, or persisted operations best meets the security goal. Done means relevant queries work with cost enforcement enabled without permitting excessive server work.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp, graphql
- Domain
- api, backend-api-design, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100