Usage of graphql.servlet.max-query-complexity

[nidomiro]

I want to secure my GraphQL endpoint in therms of serverload. I read this article and wanted to implement some methods.

With some searching I found the property graphql.servlet.max-query-complexity in #105. My Question is, how to use this Method? Especially where and how do I annotate the schema?

[MFoster]

That is a property to be used in the application.properties file.

[nidomiro]

Thanks for your Answer. Unfortunately hat's the part I already know. The real question is how do I define the complexity of each instruction in my schema? Or is everything predefined with a default complexity?

[MFoster]

I believe that is evaluated prior to reaching your resolver functions. Try testing by setting a very low complexity and sending it a very complex query to ensure that is the case.

[oliemansm]

@nidomiro The approach @MFoster suggested sounds sensible to me. Alternative would be following the code to see how it works, since I don't think anybody else currently has the answer readily available. If you've found the answer kindly comment it here for future reference.

[Thinkenterprise]

The instrumentation class MaxQueryComplexityInstrumentation implements the graph complexity functionality and is added by the GraphQLInstrumentationAutoConfiguration

@Bean
@ConditionalOnMissingBean
@ConditionalOnProperty(value = "graphql.servlet.max-query-complexity")
public MaxQueryComplexityInstrumentation maxQueryComplexityInstrumentation() {
   return new MaxQueryComplexityInstrumentation(maxQueryComplexity);
}

The standard calculation for each field is 1. I would be interested in how to assign a different complexity to individual fields. There is a FiledComplexityCalculator Interface wich can be implemented by the user. We could write a calculator that checks whether there is a @GraphQLComplexity - A new Annotation - annotation on the field and return this value. I could provide this function as PR if it makes sense for this project?

[sam701]

The configuration property graphql.servlet.max-query-complexity works like a charm with servlets but does not have any effect with WebFlux. Is it a known issue? Any plans to implement it?