Hi,
I tried to limit the graphql query depth to 5, it blocks graphiQL's IntrospectionQuery from execution which makes it inconsistent. Meaning, we can't see the Schema, Documentation and Types in graphiQL.
After doing some debugging, I found that IntrospectionQuery is having depth size as 13. So, exceeding the depth comparison.
As a tool, graphiQL must be allowed to do introspection, as it helps to explore the existing endpoints/queries, Type Checking, Autocomplete, etc. But, the User Queries must be checked for depth limit to avoid malicious request over server.
I couldn't find a way to handle this, but today got some workaround by overriding
the MaxQueryDepthInstrumentation but not sure if this is the elegant solution.
Please add a feature to easy configuration to set the depth limit and allow IntrospectionQuery.
This brings another feature request to give a handler to allow WhiteListed queries defined by the user.
Thanks & Regards,
Manoj
Hi,
I tried to limit the graphql query depth to
5, it blocks graphiQL'sIntrospectionQueryfrom execution which makes it inconsistent. Meaning, we can't see the Schema, Documentation and Types in graphiQL.After doing some debugging, I found that
IntrospectionQueryis having depth size as13. So, exceeding the depth comparison.As a tool, graphiQL must be allowed to do introspection, as it helps to explore the existing endpoints/queries, Type Checking, Autocomplete, etc. But, the User Queries must be checked for depth limit to avoid malicious request over server.
I couldn't find a way to handle this, but today got some workaround by overriding
the MaxQueryDepthInstrumentation but not sure if this is the elegant solution.
Please add a feature to easy configuration to set the depth limit and allow
IntrospectionQuery.This brings another feature request to give a handler to allow
WhiteListedqueries defined by the user.Thanks & Regards,
Manoj