Yaya kake tsare GraphQL API daga tambayoyi masu cin zarafi?

Question

IT Interview Practice · Accepted Answer

Sassaucin da yake sanya GraphQL mai ƙarfi shi ma yana sanya shi **wani saman DoS**: abokin ciniki na iya yin nesting na tambaya da zurfi ko neman manyan jeruka a cikin kira guda. Kana kariya a matakai — **depth limits, complexity/cost analysis, rate limiting, da auth mai kyau** — babu ɗayansu da harshen tambaya yake tilastawa a madadinka.

## Barazanar: tambayoyi marasa iyaka

```graphql
# A malicious cyclic query: each level multiplies the work exponentially
query Bomb {
  user { friends { friends { friends { friends { name } } } } }
}
```

## Kariya

- **Depth limiting** — ƙi tambayoyi da aka yi nesting fiye da, ka ce, matakai 7. Layin kariya na farko mai arha.
- **Cost/complexity analysis** — sanya kowane fili tsada, auna filayen jeri da argument ɗinsu na `first`, kuma ka ƙi kafin aiwatarwa idan jimlar ta wuce kasafi. Ya fi depth ƙarfi saboda yana lissafin faɗin jerin.
- **Rate limiting** — kasafi na kowane abokin ciniki, mafi kyau bisa **tsadar tambaya** (ba kawai adadin buƙata ba), don haka tambaya guda mai tsada ta ƙidaya kamar da yawa.
- **Persisted/allow-listed queries** — a samarwa, karɓi kawai saitin tambayoyin da aka riga aka rajista; tambayoyin ad-hoc na kwatsam ana ƙin su, wanda ke kawar da yawancin hanyoyin injection/DoS.

```js
import depthLimit from "graphql-depth-limit";
import costAnalysis from "graphql-cost-analysis";

const server = new ApolloServer({
  schema,
  validationRules: [
    depthLimit(7),                                  // block deep nesting
    costAnalysis({ maximumCost: 1000 }),            // block broad/expensive queries pre-execution
  ],
});
```

## Auth

Tabbatar sau ɗaya (tabbatar da token a cikin `context`), sannan **ba da izini kowane fili/resolver** — kada ka amince da abokin ciniki ya bar filaye. Yi dubawa a cikin resolvers ko wani layi kamar GraphQL Shield, kuma **kada ka taɓa bayyana introspection schema** ko stack traces masu tsawo a samarwa.

## Me ya sa yake da muhimmanci

Endpoints na REST suna da iyaka a zahiri; tambaya guda ta GraphQL ba ta da iyaka. Masu tambayoyin hira na senior suna son tunanin **mai-tushen-tsada** — depth wajibi ne amma bai isa ba, complexity analysis tare da persisted queries su ne ainihin amsar — da horon ba da izini kowane resolver.

Barazanar: tambayoyi marasa iyaka

Kariya

Auth

Me ya sa yake da muhimmanci

Tambayoyi masu alaƙa