Securing a GraphQL API by using a client ID

($operationPath() = '/graphql' and message.attributes.parse.GraphQLIntrospection = 'not-introspection' and message.attributes.graphql.operationType = 'subscription')

($operationPath() = '/graphql' and message.attributes.parse.GraphQLIntrospection = 'not-introspection' and message.attributes.graphql.operationType != 'subscription')

• Policy 1:

  Property	Value
  Source	Plan by Name
  Rate Limit Name	graphql-type-cost
  Operation	Consume
  Rate Limit Name	graphql-field-cost
  Operation	Consume
  Rate Limit Name	graphql-input-type-cost
  Operation	Consume

  This Rate limit policy limits calls to the GraphQL proxy API by calculating the expected cost of the query, and then correspondingly reducing the available cost balance that remains of the total configured cost limit. The expected cost is calculating by applying the weighting factors that have been attached to the types and fields in the GraphQL schema; for more information, see Using the GraphQL schema editor.

  The expected cost is calculated by the Validate policy that precedes the Rate limit policy and placed in the API context to be made available to the Rate limit policy. For details on the Validate policy, see Validate.

  The details of the cost calculations to which the referenced rate limits are applied are as follows:

  • graphql-field-cost: The weighted sum of fields being selected in a query. Fields that return values of scalar or enum types have a weight of 0.0 and therefore don't affect field cost.
    For example, consider the following query, where it is assumed that the value max in the filter argument of field Query.offices constrains the number of Office objects being returned:

    query {
      offices (filter: {location: "NY", max: 3}) {
        address {
          street
        }
      }
    }

    The Address.street field is of type String and therefore has a weight of 0.0. Non scalar and non enum field weights that are not changed in the GraphQL schema editor assume a default value of 1.0. If the Office.address field weight has been set to 3.0, the total field cost is 10.0, calculated as follows:

    Field	Weight	Field cost
    Query.offices	1.0	1 x 1.0 = 1.0
    Office.address	2.0	3 x 3.0 = 9.0
    Address.street	0.0	0.0
    	Total cost:	1.0 + 9.0 + 0.0 = 10.0

  • graphql-type-cost:

    The weighted sum of types being returned by a query. Scalar or enum types have a weight of 0.0 and therefore don't affect type cost.

    Considering the previous example, and assuming that all types have a default weight of 1.0, the total type cost is 7 (1 x Query type + 3 x Office types + 3 x Address types.

  • graphql-input-type-cost:

    The weighted sum of input types being sent in a query. Scalar or enum input types have a weight of 0.0 and therefore don't affect input type cost.

    Considering the previous example, the input type cost is 1.0, because one FilterInput type is sent in the filter argument. FilterInput.location is a String type and FilterInput.max is an Int type, so they are not included as they are scalars.

• Policy 2:

  Property	Value
  Source	Plan by Name
  Rate Limit Name	graphql-type-cost
  Operation	Replenish
  Rate Limit Name	graphql-field-cost
  Operation	Replenish

  This Rate limit policy limits calls to the GraphQL proxy API by calculating the actual cost of the query, and then correspondingly reducing the available cost balance that remains of the total configured cost limit. The actual cost is calculating by applying the weighting factors that have been attached to the types and fields in the GraphQL schema; for more information, see Using the GraphQL schema editor.

  Note that if the actual cost is less than the expected cost, this Rate limit policy will appropriately restore some of the available cost balance that had been removed by Policy 1, thereby overriding the original actual cost limitation. The actual cost might be less than the expected cost if, for example, the query requested more data than was available in a backend database. You can delete one or other of these Rate limit policies from the assembly if desired.

  Note: Such unused cost is not restored if there are GraphQL response errors. The purpose of this restriction is to prevent malicious requests that cause large amounts of erroneous backend processing while only using a small amount of cost.

  The actual cost is calculated by the Validate policy that precedes the Rate limit policy and placed in the API context to be made available to the Rate limit policy. For details on the Validate policy, see Validate.

($operationPath() = '/graphql/cost' and message.attributes.parse.GraphQLIntrospection = 'not-introspection')

($operationPath() = '/graphql' and message.attributes.parse.GraphQLIntrospection = 'standard-introspection')