Skip to content

Commit

Permalink
Merge pull request #1104 from oshalygin/docs/update-query-complexity-…
Browse files Browse the repository at this point in the history
…initialization

Update Query Complexity Documentation
  • Loading branch information
vektah authored Mar 18, 2020
2 parents c68df3c + 6f81ff9 commit a1a0261
Showing 1 changed file with 11 additions and 13 deletions.
24 changes: 11 additions & 13 deletions docs/content/reference/complexity.md
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
---
title: 'Preventing overly complex queries'
title: "Preventing overly complex queries"
description: Avoid denial of service attacks by calculating query costs and limiting complexity.
linkTitle: Query Complexity
menu: { main: { parent: 'reference' } }
menu: { main: { parent: "reference" } }
---

GraphQL provides a powerful way to query your data, but putting great power in the hands of your API clients also exposes you to a risk of denial of service attacks. You can mitigate that risk with gqlgen by limiting the complexity of the queries you allow.
Expand Down Expand Up @@ -43,20 +43,20 @@ The size of the response grows exponentially with each additional level of the `

## Limiting Query Complexity

Limiting query complexity is as simple as adding a parameter to the `handler.GraphQL` function call:
Limiting query complexity is as simple as specifying it with the provided extension package.

```go
func main() {
c := Config{ Resolvers: &resolvers{} }
gqlHandler := handler.GraphQL(
blog.NewExecutableSchema(c),
handler.ComplexityLimit(5), // This line is the key
)
http.Handle("/query", gqlHandler)


srv := handler.NewDefaultServer(blog.NewExecutableSchema(c))
srv.Use(extension.FixedComplexityLimit(5)) // This line is key
r.Handle("/query", srv)
}
```

Now any query with complexity greater than 5 is rejected by the API. By default, each field and level of depth adds one to the overall query complexity. You can also use `handler.ComplexityLimitFunc` to dynamically configure the complexity limit per request.
Now any query with complexity greater than 5 is rejected by the API. By default, each field and level of depth adds one to the overall query complexity. You can also use `extension.ComplexityLimit` to dynamically configure the complexity limit per request.

This helps, but we still have a problem: the `posts` and `related` fields, which return arrays, are much more expensive to resolve than the scalar `title` and `text` fields. However, the default complexity calculation weights them equally. It would make more sense to apply a higher cost to the array fields.

Expand All @@ -74,10 +74,8 @@ func main() {
c.Complexity.Query.Posts = countComplexity
c.Complexity.Post.Related = countComplexity

gqlHandler := handler.GraphQL(
blog.NewExecutableSchema(c),
handler.ComplexityLimit(100),
)
srv := handler.NewDefaultServer(blog.NewExecutableSchema(c))
srv.Use(extension.FixedComplexityLimit(5))
http.Handle("/query", gqlHandler)
}
```
Expand Down

0 comments on commit a1a0261

Please sign in to comment.