graphql-no-alias

library3.0.3jsnpmunverified

GraphQL directive and validation library to limit alias fields on queries and mutations, preventing batch attacks. Current stable version is 3.0.3, actively maintained with regular releases. It provides a @noAlias directive that can be applied to GraphQL types or fields, with customizable alias limits. Key differentiators: supports both schema directive and imperative configuration, includes error message customization, and offers an optional Envelop plugin for integration with Envelop-based servers. Requires graphql ^16.2.0.

security

npm install graphql-no-alias

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · GRAPHQL-NO-ALIAS

graphql-no-alias

securityjavascriptv3.0.3

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

createValidation

✓ import { createValidation } from 'graphql-no-alias'

✗ const createValidation = require('graphql-no-alias')

ESM-only since v3; CommonJS require must use .default or import from 'graphql-no-alias/cjs'

typeDefs

✓ const { typeDefs } = createValidation()

✗ import { typeDefs } from 'graphql-no-alias'

typeDefs is a string returned from createValidation(), not a direct export

validation

✓ const { validation } = createValidation()

✗ import { validation } from 'graphql-no-alias'

validation is a function returned from createValidation(), not a direct export

Shows basic setup with @noAlias directive on Mutation type, limiting aliases to 1. Demonstrates schema construction and validation rule integration.

import { createValidation } from 'graphql-no-alias'; import { buildSchema, graphqlSync } from 'graphql'; const { typeDefs, validation } = createValidation(); const schema = buildSchema(` ${typeDefs} type Query { hello: String } type Mutation @noAlias { setMessage(msg: String): String } `); const result = graphqlSync({ schema, source: ` mutation { a: setMessage(msg: "a") b: setMessage(msg: "b") } `, validationRules: [validation] }); console.log(result.errors?.[0]?.message); // 'You have exceeded the alias limit...'

Debug

Known issues

breakingSwitched to ESM-only in v3. CommonJS users must use dynamic import or the /cjs entry point.

fix

Use import() or switch to ES modules. If CJS required, use require('graphql-no-alias/cjs').

affects: >=3.0.0

gotchaThe 'allow' parameter in @noAlias sets the default number of allowed aliases, but if applied on a field, it overrides the type-level default. Without 'allow', the default is 1.

fix

Always specify 'allow' explicitly to avoid confusion. Example: @noAlias(allow: 2)

affects: *

gotchaIf using imperative configuration (no directive in schema), you must call createValidation with options, otherwise no aliases are restricted.

fix

Call createValidation({ fieldConfig: ... }) with proper configuration per field or type.

affects: >=1.0.0

deprecatedThe imperative configuration approach (createValidation with options) is preferred over schema directives for better performance. Directive support remains for compatibility.

fix

Migrate to imperative configuration for improved performance. See README examples.

affects: >=2.0.0

Errors

Common errors & fixes

Error: You have exceeded the alias limit for this field.

Too many aliases used on a single field beyond the configured limit.

fix

Reduce number of aliases or increase the 'allow' value in @noAlias directive or imperative config.

TypeError: createValidation is not a function

Incorrect import when using CommonJS require without .default or without /cjs entry point.

fix

Use import { createValidation } from 'graphql-no-alias' (ESM) or const { createValidation } = require('graphql-no-alias/cjs').

GraphQLError: Unknown directive '@noAlias'

Missing typeDefs from createValidation() in the schema.

fix

Ensure you interpolate ${typeDefs} into your schema string before building it.

Validation failed: Query root type must be provided.

Using @noAlias on a type without making it a root type (Query/Mutation) or missing root type.

fix

Apply @noAlias only on Query, Mutation, or their fields, and ensure schema defines them as root types.

Upgrade

Version history

3.0.3latest on npm

Audit

Dependencies

graphqloptionalPeer dependency required for GraphQL schema and validation integration

Agent activity

14 hits · last 30 days

node

Resources

githubhttps://github.com/ivandotv/graphql-no-alias ↗

packagegraphql-no-alias ↗

homepagehttps://github.com/ivandotv/graphql-no-alias#readme ↗