Unalindaje API ya GraphQL dhidi ya queries za unyanyasaji?

Question

IT Interview Practice · Accepted Answer

Unyumbufu unaofanya GraphQL kuwa yenye nguvu pia huifanya kuwa **eneo la DoS**: client anaweza kufungamanisha query kwa kina au kuomba lists kubwa katika mwito mmoja. Unajilinda kwa matabaka — **vikomo vya kina, uchambuzi wa complexity/cost, rate limiting, na auth sahihi** — hakuna hata mmoja ambao lugha ya query huutekeleza kwa niaba yako.

## Tishio: queries zisizo na mipaka

```graphql
# A malicious cyclic query: each level multiplies the work exponentially
query Bomb {
  user { friends { friends { friends { friends { name } } } } }
}
```

## Ulinzi

- **Depth limiting** — kataa queries zilizofungamanishwa zaidi ya, tuseme, ngazi 7. Mstari wa kwanza wa ulinzi wa bei nafuu.
- **Cost/complexity analysis** — pangia kila field gharama, pima uzito wa list fields kwa argument yao ya `first`, na kataa kabla ya utekelezaji ikiwa jumla itazidi bajeti. Yenye nguvu zaidi kuliko depth pekee kwa sababu huzingatia upana wa list.
- **Rate limiting** — bajeti za kila-client, ikiwezekana kwa **query cost** (si tu idadi ya maombi), ili query moja ghali ihesabike kama nyingi.
- **Persisted/allow-listed queries** — katika production, kubali tu seti iliyosajiliwa mapema ya queries; queries za ad-hoc za kiholela hukataliwa, jambo linaloondoa vekta nyingi za injection/DoS.

```js
import depthLimit from "graphql-depth-limit";
import costAnalysis from "graphql-cost-analysis";

const server = new ApolloServer({
  schema,
  validationRules: [
    depthLimit(7),                                  // block deep nesting
    costAnalysis({ maximumCost: 1000 }),            // block broad/expensive queries pre-execution
  ],
});
```

## Auth

Hakiki mara moja (thibitisha token katika `context`), kisha **idhinisha kwa kila field/resolver** — usiamini kamwe client kuacha fields. Fanya ukaguzi katika resolvers au tabaka kama GraphQL Shield, na **usiweke wazi kamwe introspection schema** au stack traces za maneno mengi katika production.

## Kwa nini ni muhimu

Endpoints za REST zina mipaka kiasili; query moja ya GraphQL haina. Wahoji wa ngazi ya senior wanataka fikra ya **inayotegemea cost** — depth ni ya lazima lakini haitoshi, uchambuzi wa complexity pamoja na persisted queries ndio jibu halisi — na nidhamu ya uidhinishaji wa kila-resolver.

Tishio: queries zisizo na mipaka

Ulinzi

Auth

Kwa nini ni muhimu

Maswali yanayohusiana