search

pa-bru / graphql-cost-analysis

A Graphql query cost analyzer.
MIT License
667 stars 26 forks source link

DoS by using invalid queries #38

Open johannespfeiffer opened 4 years ago

johannespfeiffer commented 4 years ago

When creating invalid queries, e.g. by using fields that do not exist we can bypass the complexity costs.

Let's say the request contains 30k very small and invalid queries, then we will have at least 30k errors in the response. I would have expected that this goes into the maximumCost calculation when using defaultCost: 1.

ravangen commented 4 years ago

I suspect this problem is outside of the scope of this library. It likely depends on the server implementation you are using with is package. Relates to https://github.com/graphql/graphql-js/pull/2074