GraphQl-限制次要攻击的子征数数量
我想了解是否有一种机制来限制GraphQl查询中的子征数数量以减轻GraphQL批处理攻击。 （由于GraphQl批处理功能，每个HTTP请求可以发送多个突变请求），
例如。
{
first: changeTheNumber(newNumber: 1) {
theNumber
}
second: changeTheNumber(newNumber: 1) {
theNumber
}
third: changeTheNumber(newNumber: 1) {
theNumber
}
}
我正在使用graphQl-java-kickstart。
I want to understand if there is a mechanism to limit the number of subqueries within the GraphQL query to mitigate against the GraphQL batching attack. (It's possible to send more than one mutation request per HTTP request because of the GraphQL batching feature)
Eg.
{
first: changeTheNumber(newNumber: 1) {
theNumber
}
second: changeTheNumber(newNumber: 1) {
theNumber
}
third: changeTheNumber(newNumber: 1) {
theNumber
}
}
I'm using graphql-java-kickstart.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
在
graphql-java有两个 instrumentations check the "depth" or "complexity" or your query:您可以配置预期的最大深度/复杂性，并且查询比您配置的编号更深/更复杂，则它将被拒绝。
您可以自定义
maxQueryComplexityInstrumentation的行为，以便某些字段比其他字段算作“更复杂”（例如，您可以说一个平原字符字段比需要在需要自己的数据库请求的字段中复杂处理）。这是一个示例，在架构描述中使用自定义的指示（
复杂性）来确定字段的复杂性。如果您只想避免多次请求混凝土字段，则可以编写自己的
instrumentation或在解析器功能中使用dataFetchingEnvironment来计数其中的数量当前查询中的字段（getSelectionset（）可访问当前查询中包含的所有字段）。In
graphql-javathere are two instrumentations that can check the "depth" or "complexity" or your query:The first one checks the depth of a query (how many levels are requests) the second one counts the fields. You can configure the expected max depth/complexity and if a query is deeper/complexer than your configured number it is rejected.
You can customize the behaviour of the
MaxQueryComplexityInstrumentationso that some fields count as "more complex" than others (for example you could say a plain string field is less complex than a field that requires it's own database request when processed).Here is an example that uses a custom direcive (
Complexity) in a schema description to determine the complexity of a field.If you only want to avoid that a concrete field is requested more than once, you could write you own
Instrumentationor use theDataFetchingEnvironmentin your resolver function to count the number of that fields in the current query (getSelectionSet()gives access to all fields contained in the current query).