Registry / security / graphql-no-batched-queries

graphql-no-batched-queries

library2.0.2jsnpmunverified

GraphQL validation rule to prevent batched queries and mutations, mitigating denial-of-service and brute-force attacks. Current version is 2.0.2, released with TypeScript type definitions and supporting GraphQL v16+. The rule limits the number of root operation fields per request (default 1) and supports custom error messages. Unlike rate-limiting middleware, this is a validation-only approach that integrates directly into GraphQL execution pipelines (e.g., express-graphql, graphql-yoga, graphql-http). Also offers an optional Envelop plugin.

security

npm install graphql-no-batched-queries

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · GRAPHQL-NO-BATCHED

graphql-no-batched-queries

securityjavascriptv2.0.2

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

default

✓ import createValidation from 'graphql-no-batched-queries'

✗ const createValidation = require('graphql-no-batched-queries').default

Package uses CommonJS default export. TypeScript users can import as `import createValidation from ...` because of `esModuleInterop` or synthetic defaults.

createValidation

✓ const createValidation = require('graphql-no-batched-queries')

✗ const { createValidation } = require('graphql-no-batched-queries')

The package exports a single function as default, not as a named export.

NoBatchedQueriesRule

✓ import { NoBatchedQueriesRule } from 'graphql-no-batched-queries'

Available as a named export for those who prefer named imports; this is equivalent to the default export.

Shows how to integrate graphql-no-batched-queries as a validation rule in an express-graphql server, allowing only 1 operation per request.

import { graphqlHTTP } from 'express-graphql'; import express from 'express'; import { buildSchema } from 'graphql'; import createValidation from 'graphql-no-batched-queries'; const schema = buildSchema(` type Query { hello: String } `); const root = { hello: () => 'Hello world!', }; const validation = createValidation({ allow: 1 }); const app = express(); app.use( '/graphql', graphqlHTTP({ schema, rootValue: root, graphiql: false, validationRules: [validation], }) ); app.listen(4000, () => console.log('GraphQL server running on http://localhost:4000/graphql'));

Debug

Known issues

breakingVersion 2.0.0 dropped support for GraphQL v15; only GraphQL v16.3.0+ is supported.

fix

Upgrade to GraphQL v16.3.0 or later.

affects: >=2.0.0

deprecatedThe envelop plugin (imported from 'graphql-no-batched-queries/envelop') is deprecated as of v2.0.0; use 'graphql-no-batched-queries/envelop-plugin' instead.

fix

Update import to 'graphql-no-batched-queries/envelop-plugin'.

affects: >=2.0.0 <2.0.2

gotchaThe validation rule still passes if a query uses aliases for different fields; it only counts root operation fields by name.

fix

Use in combination with graphql-no-alias directive to prevent duplicate field aliases.

affects: *

Errors

Common errors & fixes

Must provide a valid GraphQL schema.

Attempting to create validation without a schema or with an invalid one.

fix

Ensure you pass a valid GraphQLSchema object to the GraphQL server.

Cannot read properties of undefined (reading 'definitions')

Using the validation rule without GraphQL v16 (document AST structure changed).

fix

Upgrade to graphql v16.3.0 or later.

Invalid configuration: allow must be a positive integer.

Passing a non-integer or negative value to the `allow` option.

fix

Set `allow` to a positive integer (e.g., 1, 2, ...).

Upgrade

Version history

2.0.2latest on npm

Audit

Dependencies

graphqlrequiredpeer dependency; package exports a GraphQL validation rule conforming to the GraphQL.js spec

Agent activity

16 hits · last 30 days

node

Amazon

OpenAI (training)

Resources

githubhttps://github.com/ivandotv/graphql-no-batched-queries ↗

packagegraphql-no-batched-queries ↗

homepagehttps://github.com/ivandotv/graphql-no-batched-queries#readme ↗