{"_id":"graphql-query-count-limit","_rev":"1-26bde78fd1c48cef7cf614332fe6f342","name":"graphql-query-count-limit","dist-tags":{"latest":"1.0.0"},"versions":{"1.0.0":{"name":"graphql-query-count-limit","version":"1.0.0","description":"A validator for the number of queries per request and root selectors per query.","keywords":["graphql","complexity","query","count","limit","security"],"repository":{"type":"git","url":"git+ssh://git@github.com/teamstarter/graphql-query-count-limit.git"},"author":{"name":"vincent desmares","email":"vincent.desmares@gmail.com"},"license":"BSD-3-Clause","engines":{"node":">=9.11.2"},"main":"index.js","scripts":{"release":"standard-version"},"bugs":{"url":"https://github.com/teamstarter/graphql-query-count-limit/issues"},"homepage":"https://github.com/teamstarter/graphql-query-count-limit#readme","peerDependencies":{"graphql":"*"},"devDependencies":{"graphql":"^0.10.5","standard-version":"^8.0.1"},"gitHead":"003890659b92152706f1b996568092bd46829b96","_id":"graphql-query-count-limit@1.0.0","_nodeVersion":"12.14.0","_npmVersion":"6.13.4","dist":{"integrity":"sha512-QUCJDAXcKEkbgpniM36cL+y3l+DqDD0Xb3voCcSPvvoKupICne+n2/BmyGH9hX1Y01j9EYeCItXfI+3dc/PJBw==","shasum":"6797180b3f6d0ccc6cde568402cfd87fc0ea94d3","tarball":"https://registry.npmjs.org/graphql-query-count-limit/-/graphql-query-count-limit-1.0.0.tgz","fileCount":4,"unpackedSize":5693,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJfDGHsCRA9TVsSAnZWagAAL5sP/jeamsIKWEMlnkCHyVKV\naVNBibCS/o19k80Gad0BAWWuECzZVWBk5GcOvu15fPIHEykkUK3zEg+fhrat\nsxlkt1oJtK8f9rJ/MY7oCt7wHnEOC6ZvJDHp3d/vrT1KaUouKkpEohNmn86T\npFnwTXCfML74FYjkrsV2EbpskO5q86WNZgzY1oK4ef7YPWaN7TfqVZJ9ypcC\nOyHK4aXGrvTJ1aVioRbuBKf0/pfPRQUVJT/imAvPGBsCGvR0sYbKyEg22tEF\n/A2/k6G/rsq2snqskuSwLtFQZrHZsO3YwIHOZZXtpOC7LSk4611ifqoYUGxM\nHRgBBf7MfO5KvbvyM3nTjvy9nCob6vRNV7xgE3QPlgdNTR5i449WOF5GG2Wi\noX1x7PEVHiELYJLu+ZGJR3rdAs7xV1cR402l3NNLDYvEMiKdTTeBVFOYaGAB\nq29gcWYfO/I9FakdQdgR+Pd0HJH+eQk60MTiCF7wH1PY0WsAVG+qhxBnWDNF\n5Y9i7WYLkwEihrvG91nnGBlOYmTE1Xt9n0cvzCtbLt6BykxP2G0la+Scv2cP\nsyMc2vSLjhKP4L0kna0JHVjc1YP9SAnaJF8nGy+XiFWVk1B7pgNcCKBew0uC\nONjNS65P1x4hdLRObtyo8O6rf0kbMPV6HmrB+f5Rc0Hd9oD6ElWzUakZS/kl\nKkZh\r\n=3Co6\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIQDCl4PQHY0Eu8+ZIGGxFHZNr1QQ+CA3R90rIc4VgieK0QIgMxvRoz5GbXI8bCJJRTU+up0M5VBdvScTasoBVdFJyL4="}]},"maintainers":[{"name":"coldlestat","email":"vincent.desmares@gmail.com"}],"_npmUser":{"name":"coldlestat","email":"vincent.desmares@gmail.com"},"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/graphql-query-count-limit_1.0.0_1594647020194_0.2960733798003192"},"_hasShrinkwrap":false}},"time":{"created":"2020-07-13T13:30:20.193Z","1.0.0":"2020-07-13T13:30:20.324Z","modified":"2022-05-04T03:08:58.334Z"},"maintainers":[{"name":"coldlestat","email":"vincent.desmares@gmail.com"}],"description":"A validator for the number of queries per request and root selectors per query.","homepage":"https://github.com/teamstarter/graphql-query-count-limit#readme","keywords":["graphql","complexity","query","count","limit","security"],"repository":{"type":"git","url":"git+ssh://git@github.com/teamstarter/graphql-query-count-limit.git"},"author":{"name":"vincent desmares","email":"vincent.desmares@gmail.com"},"bugs":{"url":"https://github.com/teamstarter/graphql-query-count-limit/issues"},"license":"BSD-3-Clause","readme":"GraphQL Query Count Limit\n===================\n\nDead-simple defense against grouped GraphQL queries. Limit the number of the queries per request and the number of selections allowed at the root of each query.\n\n\n## Why?\n\nSuppose you have an `Album` type that has a list of `Song`s.\n\n```graphql\n{\n  album(id: 42) {\n    songs {\n      title\n      artists\n    }\n  }\n}\n```\n\nAnd perhaps you have a different entry point for a `Song` and the type allows you to go back up to the `Album`.\n\n```graphql\n{\n  song(id: 1337) {\n    title\n    album {\n      title\n    }\n  }\n}\n```\n\nThat opens your server to the possibility of a cyclical query!\n\n```graphql\nquery evil {\n  album(id: 42) {\n    songs {\n      album {\n        songs {\n            # Depth is covered by graphql-depth-limit...\n          }\n        }\n      }\n    }\n  }\n  album(id: 41) {\n    songs {\n      album {\n        songs {\n            # but one can add as many selection at the root of the query\n          }\n        }\n      }\n    }\n  }\n  # Creating a single-call-ddos\n  ...\n}\n# Also, most engines handles any number queries per request! Making another possible single-call-ddos possibility.\nquery evil2 {\n  album(id: 42) {\n    songs {\n      album {\n        songs {\n            ...\n          }\n        }\n      }\n    }\n  }\n  ...\n}\n```\n\n## Liming root selections and queries\n\ngraphql-query-count-limit will limit the number of queries per request and the number of root selections per query.\n\n## Usage\n\n```shell\n$ npm install graphql-query-count-limit\n```\n\nIt works with any library using graphql-server, such as, [apollo-server](https://www.apollographql.com/docs/apollo-server/), [express-graphql](https://github.com/graphql/express-graphql) and [koa-graphql](https://github.com/chentsulin/koa-graphql).\n\nHere is an example with Express.\n\n```js\nimport queryLimit from 'graphql-query-count-limit'\nimport express from 'express'\nimport graphqlHTTP from 'express-graphql'\nimport schema from './schema'\n\nconst app = express()\n\napp.use('/graphql', graphqlHTTP((req, res) => ({\n  schema,\n  validationRules: [ queryLimit(10) ]\n})))\n```\n\nThe first argument is the maximum number of queries in a single request. This will throw a validation error if more than the allowed amount if queries are specified.<br/>\nThe second, optional, argument is the maximum amount of root selections on any query<br/>\n\n```js\nqueryLimit(\n  3,\n  5\n)\n```\n\n## References\n\nThis library is made thanks to the awesome [graphql-depth-limit](https://github.com/stems/graphql-depth-limit) library that you should always install with graphql-query-count-limit as they are both needed for a better DDOS protection.\n\nAlso, once those two librairies are installed, you will still have to make sure that:\n\n* Limits/offset are enforced on all \"list\" endpoints\n* You have a rate limit system put in place","readmeFilename":"README.md"}