Feat: Allow skipping complexity check in Harden Plugin #3340
Conversation
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
|
@michaelbromley Not sure why tests are failing, HardenPlugin doesn't seem to be included in any e2e tests. Someone else broke the minor branch maybe? |
| const maxQueryComplexity = this.options.maxQueryComplexity ?? 1000; | ||
| return { | ||
| didResolveOperation: async ({ request, document }) => { | ||
| if (isAdminApi(schema)) { | ||
| if (this.options.skip?.(ctx)) { |
There was a problem hiding this comment.
It would be great if this supported Awaitable<boolean> in addition to boolean. Supporting promises would allow developers to include external resources, such as making a third-party validation request.
There was a problem hiding this comment.
I purposely did not do that, because it can have severe performance impact if you do anything async in every request.
But I guess we can move that responsibility to the consumer.... Let me add it.
|
Description
We are using the Harden Plugin, but would like to be able to skip the complexity check for storefront SSR builds.
This PR introduces an optional
skipfunction, inspired by express-rate-limit, that allows the consumer to skip certain requests.Screenshots below we're tested with the following config:
This skips the complexity check when the header
x-skip-complexityis present. In production use, you would check for a token or something.Breaking changes
No
Screenshots
Complex query without header
The same complex query with custom header
And, another test without a
skipfunction specified.Checklist
📌 Always:
👍 Most of the time: