GraphQL security best practices - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to limit the maximum query depth in a GraphQL server.

GraphQL

const depthLimit = require('graphql-depth-limit');
const server = new ApolloServer({
  schema,
  validationRules: [[1](5)]
});

Drag options to blanks, or click blank then click option'

AdepthLimit

BmaxDepth

ClimitDepth

DdepthCheck

Attempts:

3 left

💡 Hint

Common Mistakes

Using a non-existent function name like maxDepth.

Forgetting to wrap the function call with parentheses.

The depthLimit function is used to limit the maximum depth of a GraphQL query to prevent overly complex queries.

2fill in blank

medium

Complete the code to enable query complexity analysis in a GraphQL server.

GraphQL

const queryComplexity = require('graphql-query-complexity');
const server = new ApolloServer({
  schema,
  validationRules: [queryComplexity({
    maximumComplexity: [1],
    onComplete: (complexity) => console.log('Query Complexity:', complexity)
  })]
});

Drag options to blanks, or click blank then click option'

A10

B10000

C1000

D100

Attempts:

3 left

💡 Hint

Common Mistakes

Setting the complexity too high, which defeats the purpose.

Setting the complexity too low, which may block valid queries.

Setting maximumComplexity to 100 helps prevent very expensive queries that could overload the server.

3fill in blank

hard

Fix the error in the code to properly disable introspection in a GraphQL server.

GraphQL

const { ApolloServerPluginLandingPageDisabled } = require('apollo-server-core');
const server = new ApolloServer({
  schema,
  plugins: [[1]()]
});

Drag options to blanks, or click blank then click option'

AApolloServerPluginIntrospectionDisabled

BApolloServerPluginLandingPageDisabled

CDisableIntrospectionPlugin

DIntrospectionOffPlugin

Attempts:

3 left

💡 Hint

Common Mistakes

Using a non-existent plugin name.

Forgetting to call the plugin as a function.

The ApolloServerPluginLandingPageDisabled plugin disables the GraphQL playground and introspection queries for security.

4fill in blank

hard

Fill both blanks to implement rate limiting middleware for a GraphQL server.

GraphQL

const rateLimit = require('express-rate-limit');
const limiter = rateLimit({
  windowMs: [1],
  max: [2]
});
app.use('/graphql', limiter);

Drag options to blanks, or click blank then click option'

A15 * 60 * 1000

B100

C1000

D60 * 1000

Attempts:

3 left

💡 Hint

Common Mistakes

Setting windowMs to seconds instead of milliseconds.

Setting max too high or too low.

The windowMs is set to 15 minutes (15 * 60 * 1000 ms), and max is set to 100 requests per window to limit client requests.

5fill in blank

hard

Fill all three blanks to add authentication and authorization checks in a GraphQL resolver.

GraphQL

const resolvers = {
  Query: {
    user: (parent, args, context) => {
      if (!context.[1]) {
        throw new Error('Not authenticated');
      }
      if (!context.user.[2].includes('admin')) {
        throw new Error('Not authorized');
      }
      return getUserById(args.id);
    }
  }
};

Drag options to blanks, or click blank then click option'

AisAuthenticated

Broles

Cpermissions

Dauth

Attempts:

3 left

💡 Hint

Common Mistakes

Checking authorization before authentication.

Using incorrect property names in context.

The context.isAuthenticated checks if the user is logged in, context.user.roles holds user roles, and includes('admin') checks if the user has admin rights.