英文:
How to prevent clients from navigating my GraphQL schema?
问题
好的，这是一个理论问题，所以我没有任何代码可以展示。假设我有如下的 GraphQL 类型：
type A {
field1: String!
field2: B!
}
type B {
fieldB1: Int!
fieldB2: C!
aRef: A!
}
type C {
fieldC1: Boolean!
fieldC2: D!
bRef: B!
}
我的问题是，假设有一个查询可以进入我的图中的某一点。我如何防止客户端沿着图遍历到任意深度，并要求比他们应该得到的数据要多。有没有办法限制查询可以遍历多少关系？我能在服务器端控制这个吗？如何阻止查询从 A 到 B 再到 C，以及不受限制地继续往下到达 D 等等？
英文:
Okay so this is a theoretical question so I don't have any code to show. Consider that I have GraphQL types like so:
type A {
field1: String!
field2: B!
}
type B {
fieldB1: Int!
fieldB2: C!
aRef: A!
}
type C {
fieldC1: Boolean!
fieldC2: D!
bRef: B!
}
So my question is that given a query which can enter some point in my graph. How do I prevent clients from travelling that graph to an arbitrary depth and asking for way more data than they should. Is there any way to restrict how many relationships a query can navigate ? Can I control this on server side ? How do I stop queries which can navigate from A to B to C to D and so forth without restriction ?
答案1
得分: 1
当前的GraphQL规范（可以在https://spec.graphql.org/上阅读）并未定义深度限制功能作为规范的一部分。
然而，许多GraphQL服务器实现支持深度限制以防止循环查询 - 或者有一些软件包可以实现此功能（例如NodeJS的graphql-depth-limit）。
你想要搜索的关键词是GraphQL的深度限制。
一篇不错的阅读是文章GraphQL Cyclic Queries and Depth Limiting：
许多GraphQL实现提供一个特定的参数，你只需将其设置为一个给定值，这样超过该深度级别的查询将被GraphQL引擎自动忽略，甚至不会开始评估。
有几种不同的方法，取决于你所使用的GraphQL引擎：
Apollo、Express GraphQL、GraphQL Node
英文:
The current GraphQL specification (which can be read https://spec.graphql.org/) does not have depth limit features defined as part of the spec.
However, many GraphQL server implementations support a depth limit to prevent cyclic queries - or there are packages which does this (for example graphql-depth-limit for NodeJS)
The keyword you want to search for is depth limit for GraphQL.
A good read is an article GraphQL Cyclic Queries and Depth Limiting:
>Many GraphQL implementations provide a specific parameter that you just have to set to a given value so that queries that exceed this depth level are automatically ignored by the GraphQL engine, without even starting the evaluation.
>
>There are several ways to proceed, depending on the GraphQL engine you use:
>
>Apollo, Express GraphQL, GraphQL Node
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。
评论