Registry / security / graphql-cost-analysis

graphql-cost-analysis

library1.0.3jsnpmunverified

GraphQL query cost analysis library for protecting GraphQL servers against DoS attacks by computing and limiting query cost. Version 1.0.3, stable with infrequent releases. Supports cost directives and Type Map objects for per-field cost configuration. Differentiates by integrating as a validation rule in graphql-js servers (express-graphql, Apollo Server). Requires graphql >=0.11.7 as peer dependency. Allows dynamic cost multipliers based on arguments like pagination limits.

security

npm install graphql-cost-analysis

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · GRAPHQL-COST-ANALY

graphql-cost-analysis

securityjavascriptv1.0.3

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

costAnalysis

✓ import costAnalysis from 'graphql-cost-analysis'

✗ const costAnalysis = require('graphql-cost-analysis')

Default import; package is ESM-first. CJS require() may fail in Node <12 or without transpilation.

default as costAnalysis

✓ const costAnalysis = require('graphql-cost-analysis').default

✗ const costAnalysis = require('graphql-cost-analysis')

If using CommonJS, you must access the .default property because the package uses ESM.

createCostAnalysis

✓ import costAnalysis from 'graphql-cost-analysis'

No named export exists; always use default import.

Integrates cost analysis as a validation rule in express-graphql, setting a max cost and using a cost map for the Query.users field with a multiplier.

import costAnalysis from 'graphql-cost-analysis'; import { graphqlHTTP } from 'express-graphql'; import schema from './schema'; app.use('/graphql', graphqlHTTP((req, res, graphQLParams) => ({ schema, graphiql: true, validationRules: [ costAnalysis({ variables: graphQLParams.variables, maximumCost: 1000, defaultCost: 1, costMap: { Query: { users: { multipliers: ['limit'], useMultipliers: true, complexity: 5 }, }, }, }), ], })));

Debug

Known issues

breakingESM-only: default export is not a function in CommonJS require()

fix

Use import or require('...').default

affects: >=1.0.0

gotchaCost directives are ignored if costMap is provided in configuration

fix

Either use cost directives in schema OR costMap in config, not both

affects: >=1.0.0

gotchaVariables must be passed explicitly; they are not automatically extracted from the request

fix

Pass variables from request body to the costAnalysis options

affects: >=1.0.0

deprecatedcostMap may be deprecated in future versions; use directives instead

fix

Use @cost directive on schema fields for forward compatibility

affects: >=1.0.0

Errors

Common errors & fixes

TypeError: costAnalysis is not a function

Using CommonJS require() without accessing .default

fix

const costAnalysis = require('graphql-cost-analysis').default;

Cannot find module 'graphql-cost-analysis'

Package not installed or missing from node_modules

fix

npm install --save graphql-cost-analysis

Variable not provided: the cost analysis requires variables to compute costs

Variables option not passed to costAnalysis

fix

Pass variables: req.body.variables or graphQLParams.variables in the config

Upgrade

Version history

1.0.3latest on npm

Audit

Dependencies

graphqlrequiredPeer dependency - works as validation rule for graphql-js servers

Agent activity

15 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/pa-bru/graphql-cost-analysis ↗

packagegraphql-cost-analysis ↗

homepagehttps://github.com/pa-bru/graphql-cost-analysis ↗