I check the security(https://www.howtographql.com/advanced/4-security/) before deploying the lighthouse on the production server. so i decided to check query depth, query complexity
In the lighthouse documentation, they mentioned config/lighthouse.php,
/*
|--------------------------------------------------------------------------
| Security
|--------------------------------------------------------------------------
|
| Control how Lighthouse handles security related query validation.
| Read more at https://webonyx.github.io/graphql-php/security/
|
*/
'security' => [
'max_query_complexity' => \GraphQL\Validator\Rules\QueryComplexity::DISABLED,
'max_query_depth' => \GraphQL\Validator\Rules\QueryDepth::DISABLED,
'disable_introspection' => \GraphQL\Validator\Rules\DisableIntrospection::DISABLED,
],
and recommeded to read https://webonyx.github.io/graphql-php/security/
in this link, they give some examples,
use GraphQL\GraphQL;
use GraphQL\Validator\Rules\QueryComplexity;
use GraphQL\Validator\DocumentValidator;
$rule = new QueryComplexity($maxQueryComplexity = 100);
DocumentValidator::addRule($rule);
GraphQL::executeQuery(/*...*/);
use GraphQL\GraphQL;
use GraphQL\Validator\Rules\QueryDepth;
use GraphQL\Validator\DocumentValidator;
$rule = new QueryDepth($maxDepth = 10);
DocumentValidator::addRule($rule);
GraphQL::executeQuery(/*...*/);
but how to apply these in lighthouse?
in first time, i wrote those code to ExampleQuery.php(php artisan lighthouse:query ExampleQuery)
final class ExampleQuery
{
public function __invoke(_, array $args)
{
$rule = new QueryComplexity(2);
DocumentValidator::addRule($rule);
$rule2 = new QueryDepth(2);
DocumentValidator::addRule($rule2);
return [
...
];
}
}
but that can`t catch any problems.
I think lighthouse start in vendor/nuwave/.../GraphQLController.php
So i can't execute GraphQL::executeQuery(/*...*/);
and @complexity directive not working,
@complexity(resolver: "App\\Security\\ComplexityAnalyzer@userPosts") doesn`t call userPosts function.
class ComplexityAnalyzer {
public function userPosts(int $childrenComplexity, array $args): int // not called
{
$postComplexity = $args['includeFullText']
? 3
: 2;
\Log::Debug($postComplexity); // not called
return $childrenComplexity * $postComplexity;
}
}
what am i missing..? please help make me sleep comfortable.