GraphAttack
GraphQL analyser for blocking & throttling.
Usage
This gem adds a method to limit access to your GraphQL fields by IP address:
class QueryType < GraphQL::Schema::Object
field :some_expensive_field, String, null: false do
extension GraphAttack::RateLimit, threshold: 15, interval: 60
end
# …
end
This would allow only 15 calls per minute by the same IP address.
Requirements
Requires GraphQL Ruby and a running instance of Redis.
Installation
Add these lines to your application’s Gemfile
:
# GraphQL analyser for blocking & throttling by IP.
gem "graph_attack"
And then execute:
$ bundle
Finally, make sure you add the current user’s IP address as ip:
to the
GraphQL context. E.g.:
class GraphqlController < ApplicationController
def create
result = ApplicationSchema.execute(
params[:query],
variables: params[:variables],
context: {
ip: request.ip,
},
)
render json: result
end
end
If that key is nil
, throttling will be disabled.
Configuration
Custom context key
If you want to throttle using a different value than the IP address, you can
choose which context key you want to use with the on
option. E.g.:
extension GraphAttack::RateLimit,
threshold: 15,
interval: 60,
on: :client_id
Custom Redis client
Use a custom Redis client instead of the default with the redis_client
option:
extension GraphAttack::RateLimit,
threshold: 15,
interval: 60,
redis_client: Redis.new(url: "…")
Common configuration
To have a default configuration for all rate-limited fields, you can create an initializer:
GraphAttack.configure do |config|
# config.threshold = 15
# config.interval = 60
# config.on = :ip
# config.redis_client = Redis.new
end
Development
After checking out the repo, run bin/setup
to install dependencies. Then, run
bin/rake
to run the tests and the linter. You can also run bin/console
for
an interactive prompt that will allow you to experiment.
Versionning
We use SemVer for versioning. For the versions available, see the tags on this repository.
Releasing
To release a new version, update the version number in version.rb
and in the
CHANGELOG.md
. Update the README.md
if there are missing segments, make sure
tests and linting are pristine by calling bundle && bin/rake
, then create a
commit for this version, for example with:
git add --patch
git commit -m v`ruby -rbundler/setup -rgraph_attack/version -e "puts GraphAttack::VERSION"`
You can then run bin/rake release
, which will assign a git tag, push using
git, and push the gem to rubygems.org.
Contributing
Bug reports and pull requests are welcome on GitHub at https://github.com/sunny/graph_attack. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the Contributor Covenant code of conduct.
Code of Conduct
Everyone interacting in the GraphAttack project’s codebases, issue trackers, chat rooms and mailing lists is expected to follow the code of conduct.
License
This project is licensed under the MIT License - see the LICENSE.md file for details.
Authors
Acknowledgments
Hat tip to Rack::Attack for the the name.