Package com.predic8.membrane.core.graphql

Class GraphQLProtectionInterceptor

java.lang.Object
com.predic8.membrane.core.interceptor.AbstractInterceptor
com.predic8.membrane.core.graphql.GraphQLProtectionInterceptor
All Implemented Interfaces:
Interceptor
public class GraphQLProtectionInterceptor extends AbstractInterceptor
Description
Check GraphQL-over-HTTP requests, enforcing several limits and/or restrictions. This effectively helps to reduce the attack surface.

GraphQL Specification "October2021" is used. (But GraphQL only covers formulation of Documents/Queries.)

GraphQL-over-HTTP, which specifies how to submit GraphQL queries via HTTP, has not been released/finalized yet. We therefore use Version a1e6d8ca.

Only GraphQL documents conforming to the 'ExecutableDocument' of the grammar are allowed: This includes the usual 'query', 'mutation', 'subscription' and 'fragment's.

  • Constructor Details

    • GraphQLProtectionInterceptor

      public GraphQLProtectionInterceptor()

  • Method Details

    • init

      public void init() throws Exception
      Description copied from class: AbstractInterceptor
      Called after parsing is complete and this has been added to the object tree (whose root is Router).
      Overrides:
      init in class AbstractInterceptor
      Throws:
      Exception

    • handleRequest

      public Outcome handleRequest(Exchange exc) throws Exception
      Specified by:
      handleRequest in interface Interceptor
      Overrides:
      handleRequest in class AbstractInterceptor
      Throws:
      Exception

    • setMaxMutations

      public void setMaxMutations(int maxMutations)
      Default
      5
      Description
      Limit how many mutations can be defined in a document query.
      Example
      2

    • getMaxMutations

      public int getMaxMutations()

    • setAllowExtensions

      public void setAllowExtensions(boolean allowExtensions)
      Default
      false
      Description
      Whether to allow GraphQL "extensions".
      Example
      true

    • isAllowExtensions

      public boolean isAllowExtensions()

    • getAllowedMethods

      public String getAllowedMethods()

    • setAllowedMethods

      public void setAllowedMethods(String allowedMethods)
      Default
      GET, POST
      Description
      Which HTTP methods to allow. Note that per the GraphQL-over-HTTP spec, you need POST for mutation or subscription queries.

    • getMaxRecursion

      public int getMaxRecursion()

    • setMaxRecursion

      public void setMaxRecursion(int maxRecursion)
      Default
      3
      Description
      How deep recursive parts of queries can be nested.

    • getMaxDepth

      public int getMaxDepth()

    • setMaxDepth

      public void setMaxDepth(int maxDepth)
      Default
      7
      Description
      How deep queries can be nested.

    • toString

      public String toString()
      Overrides:
      toString in class Object

    • getShortDescription

      public String getShortDescription()
      Specified by:
      getShortDescription in interface Interceptor
      Overrides:
      getShortDescription in class AbstractInterceptor

    • getLongDescription

      public String getLongDescription()
      Specified by:
      getLongDescription in interface Interceptor
      Overrides:
      getLongDescription in class AbstractInterceptor