Feature Request: Rate limiting and Scoring

[ozum]

Would like to have rate limiting (# per user per second) and scoring of query cost (score per user per minute etc.).

Below points mentioned in https://blog.apollographql.com/securing-your-graphql-api-from-malicious-queries-16130a324a6b seems to nice to have in Hasura.

• Size Limiting
• Depth Limiting
• Query Cost Analysis

Kind Regards,

[kriswep]

I'd second this.

You could easily imagine malicious queries taking down APIs powered by Hasura.
For example, running the following query against the todo learning API takes some time, and you could easily extend the nesting there:

{
  todos {
    user {
      todos {
        id
        user {
          id
          todos {
            id
          }
        }
      }
    }
  }
}

For the record, there was some discussion around this in #346, #989 and #1283 but they don't seem to have lead anywhere.

[coco98]

@kriswep Allowlists (#989) is ready for review and testing and should land soon. :)
#2075

The rest are fairly complicated and we're coming to it gradually!

[kriswep]

That's good to hear, haven't seen that before.
But there are uses cases which query whitelisting doesn't fulfill (having a public facing API with unknown clients).
Guess I hope other options like depth-limitng and costs analysis won't be forgetten.

[ozum]

The rest are fairly complicated and we're coming to it gradually!

I agree. Maybe starting with depth limiting would be easier and have relatively great impact on stopping malicious queries.

[ptrobert]

Wish List
For rate limiting it will be good to have a per user per min/hour/ day/ month limits.
A list of blocked users has to be maintained and ability to unblock them.
Support for remote schemas as well

[mfdeux]

@ptrobert Short-term, most of those could be solved using the webhook auth method.

[txchen]

@mfdeux currently hasura is not forwarding the graphql query name/query details. If I want to do rate limit on insertions to a certain collection/table, how can we do it with webhook?

[mfdeux]

Ok, I understand. A short term hack I’m using is running through a proxy and parsing the query (using JS or Go), and then implementing rate limiting based on that, but obviously not a long term soution.

…

On Sat, Aug 3, 2019 at 21:25 Tianxiang Chen ***@***.***> wrote: @mfdeux <https://github.com/mfdeux> currently hasura is not forwarding the graphql query name/query details. If I want to do rate limit on insertions to a certain collection/table, how can we do it with webhook? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#2151?email_source=notifications&email_token=AEZLJ2I6FWS4YSGVCUVXGULQCYVYVA5CNFSM4HL2LKZ2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD3PYTBI#issuecomment-517966213>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AEZLJ2OFJZMKZFNSHTAE623QCYVYVANCNFSM4HL2LKZQ> .

[txchen]

Yes, that can be a solution, but not very easy to use :)
If hasura can forward more context info to webhook, and extend the protocol, I think rate limiting / recaptcha can be done easily.

[ptrobert]

opened a feature request for passing hasura query/mutation into webhook auth post body #2666