Graphql validation with accompanying directive to limit the number of alias queries and mutations that can be sent to the GraphQL server.
It will disable certain kinds of attacks that look like this.
// batch query attack (hello DoS)
query {
getUsers(first: 1000)
second: getUsers(first: 2000)
third: getUsers(first: 3000)
fourth: getUsers(first: 4000)
}
// or batch login attack
mutation {
login(pass: 1111, username: "ivan")
second: login(pass: 2222, username: "ivan")
third: login(pass: 3333, username: "ivan")
fourth: login(pass: 4444, username: "ivan")
}
`You can read more batching attacks here: https://lab.wallarm.com/graphql-batching-attack/
npm i graphql-no-aliasThere are two ways to use this validation:
- Using the
directivein theschema - Using the configuration options(better performance)
There are two parts, a @noAlias directive that needs to be added to the schema, and a validation function that needs to be added to the GraphQL server validationRules array.
In the example that follows hello query will be allowed 2 calls per request, while all the mutations will be limited to 1 call per mutation by setting the @noAlias directive directly on the Mutation type.
const express = require('express')
const { graphqlHTTP } = require('express-graphql')
const { buildSchema } = require('graphql')
const { createValidation } = require('graphql-no-alias')
// get the validation function and type definition of the declaration
const { typeDefs, validation } = createValidation()
//add type defintion to schema
const schema = buildSchema(`
${typeDefs}
type Query {
hello: String @noAlias(allow:2)
}
type Mutation @noAlias {
muteOne(n:Int):String
}
`)
const app = express()
app.use(
'/graphql',
graphqlHTTP({
schema: schema,
rootValue: root,
graphiql: true,
validationRules: [validation] //add the validation function
})
)
app.listen(4000)The declaration can be used on the object type (Query or Mutation) or type fields (particular query or mutation). When the declaration is used on the type it affects all the fields of that type (Query or Mutation).
In the next example all queries will be limited to only one call.
const schema = buildSchema(`
type Query @noAlias {
getUser: User
getFriends: [User]!
}
`)client reqeust:
query {
getUser
alias_get_user: getUser // Error - validation fails
getFriends
alias_get_friends: getFriends // Error - validation fails
}The directive also accepts one parameter allow which declares the default number of allowed aliases.
In the next example, all queries will be allowed to have 3 calls (one original, two aliases)
var schema = buildSchema(`
type Query @noAlias(allow:3) {
getUser: User
getFriends: [User]!
}
`)On the client:
query {
getUser
alias_2: getUser
alias_3: getUser
alias_4: getUser // Error - validation fails
}Usage on type fields is the same as on the object type, one difference is that when combined with object directive the one on the field will take precedence.
In the next example, all query fields will be allowed 3 batch calls, except the getFriends query, which will be allowed only 1.
var schema = buildSchema(`
type Query @noAlias(allow:3) {
getUser: User
getFriends: [User]! @noAlias(allow:1) //same as @noAlias
}
`)client request:
query {
getUser
alias_2: getUser
alias_3: getUser
getFriends
alias_1: getFriends // Error - validation fails
}The declaration can be customized to have a different name, and different default allow values, and it can also be passed a custom error function that is executed when the validation fails.
In the next example, validation will allow 3 calls to the same field by default, the directive name will be changed to NoBatchCalls, and there will be a custom error message.
const defaultAllow = 3
const directiveName = 'NoBatchCalls'
const { typeDefs, validation } = createValidation({
defaultAllow,
directiveName
})Usage:
const schema = buildSchema(`
type Query @noBatchCalls {
getUser: User @noBatchCalls(allow:4)
getFriends: [User]!
}
`)With imperative configuration, there is no need for type definition and schema modification. Instead, we use a configuration object.
This results in better performance since the schema is not analyzed (not looking for directives).
const permissions = {
Query: {
'*': 2, // default value for all queries
getAnotherUser: 5 // custom value for specific query
},
Mutation: {
'*': 1 //default value for all mutations
}
}
const { validation } = createValidation({ permissions })
const schema = buildSchema(/* GraphQL */ `
type Query {
getUser: User
getAnotherUser: User
}
type User {
name: String
}
`)
const app = express()
app.use(
'/graphql',
graphqlHTTP({
schema: schema,
rootValue: root,
graphiql: true,
validationRules: [validation] //add the validation function
})
)
app.listen(4000)Please note that when the permissions object is passed to the configuration, schema directives will be ignored.
Continuing from the previous example, the error message that is reported when the validation fails can also be customized. You can return a GrahphQLError instance or just a string that will be used as the error message.
const { typeDefs, validation } = createValidation({errorFn:(
typeName: string, //type name Query or Mutation
fieldName: string,
maxAllowed: number,
node: FieldNode,
ctx: ValidationContext
): GraphQLError {
return new GraphQLError(
`Hey! allowed number of calls for ${typeName}->${fieldName} has been exceeded (max: ${maxAllowed})`
)
//or return string
return 'custom message'
}
})If you are using GraphQL Envelop. I have made a plugin that uses this directive.
I've also created another validation library: No batched queries, which limits the number of all queries and mutations that could be sent per request. It pairs nicely with this validation, so you could allow for example, 3 queries to be sent and then use noAlias directive to disable duplicate queries.
This project is licensed under the MIT License - see LICENSE file for details