# How can we secure the GraphQL API from malicious queries in Dgraph?

**URL:** <https://discuss.dgraph.io/t/how-can-we-secure-the-graphql-api-from-malicious-queries-in-dgraph/14568>\
**Category:** GraphQL\
**Tags:** graphql, kind:question, dgraph\
**Created:** [June 12, 2021, 9:22am UTC](https://discuss.dgraph.io/t/how-can-we-secure-the-graphql-api-from-malicious-queries-in-dgraph/14568 "2021-06-12T09:22:08Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![pshaddel](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/pshaddel/32/11584_2.png) [@pshaddel](https://discuss.dgraph.io/u/pshaddel)\
**Post date:** [June 12, 2021, 9:22am UTC](https://discuss.dgraph.io/t/how-can-we-secure-the-graphql-api-from-malicious-queries-in-dgraph/14568/1 "2021-06-12T09:22:08Z")

</div>

Hi guys,

We are trying to migrate from MySQL to dgraph and we want to use GraphQL API by implementing our schema after the migration, but we do not know how we can limit and prevent malicious queries.

for example what is the solution to prevent user or attacker from requesting 1000000 results(by setting first: 100000) in a query?

[This article suggests some solutions when we are using GraphQL](https://www.apollographql.com/blog/graphql/security/securing-your-graphql-api-from-malicious-queries/)

What are the solutions when we use dgraph GraphQL?

Thanks in advance

---

<div class="post-metadata">

**Author:** ![jdgamble555](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/jdgamble555/32/7503_2.png) [@jdgamble555](https://discuss.dgraph.io/u/jdgamble555)\
**Post date:** [June 12, 2021, 2:46pm UTC](https://discuss.dgraph.io/t/how-can-we-secure-the-graphql-api-from-malicious-queries-in-dgraph/14568/2 "2021-06-12T14:46:12Z")

</div>

Welcome to the forms @pshaddel !

Dgraph has an [@auth directive](https://dgraph.io/docs/graphql/authorization/directive/) that I believe you can use to do what you’re asking.

For example:

```auto
type Todo @auth(
    query: { rule: """
        query { 
            queryTodo(first: 100) { 
                id 
            } 
        }"""
    }
){
    id: ID!
    text: String! @search(by: [term])
    owner: String! @search(by: [hash])
}

```

This would only allow you to query up to 100 items, and you could use **first** in your actual code to get only the first 10 for example. These query rules, similar to policies in SQL or RLC (Row Level Security) can be quite powerful.

Basically, it filters your results before you get your actual results. You can do a lot with queries, but I believe the biggest caveat is the missing **[update-after](http://discuss.hypermode.com/t/moving-graphql-authorization-to-admin-api/13304/3)** rules in mutations. There seems to be an [internal debate](http://discuss.hypermode.com/t/field-validations/11352/5) at Dgraph on the importance of validation and verification on the backend, but luckily most people realize its importance and we should hopefully see more security features in the future.

J

---

<div class="post-metadata">

**Author:** ![pshaddel](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/pshaddel/32/11584_2.png) [@pshaddel](https://discuss.dgraph.io/u/pshaddel)\
**Post date:** [June 12, 2021, 3:00pm UTC](https://discuss.dgraph.io/t/how-can-we-secure-the-graphql-api-from-malicious-queries-in-dgraph/14568/3 "2021-06-12T15:00:22Z")

</div>

Thank you Jonathan. I just checked the query and it is working fine with filters and all the other stuff.  
Good luck

---

<div class="post-metadata">

**Author:** ![pshaddel](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/pshaddel/32/11584_2.png) [@pshaddel](https://discuss.dgraph.io/u/pshaddel)\
**Post date:** [July 4, 2021, 12:52pm UTC](https://discuss.dgraph.io/t/how-can-we-secure-the-graphql-api-from-malicious-queries-in-dgraph/14568/4 "2021-07-04T12:52:18Z")

</div>

@jdgamble555 Hi Jonathan,  
When I was testing this in Jun 12 it was working fine but right now it is not working and I cannot limit number of results. I created a backend with only one type exactly like what you noted down here:

```auto
type Todo
  @auth(
    query: {
      rule: """
      query {
          queryTodo(first: 2) {
              id
          }
      }
      """
    }
  ) {
  id: ID!
  text: String! @search(by: [term])
  owner: String! @search(by: [hash])
}

```

would you please checkout this endpoint: [https://green-pine.us-east-1.aws.cloud.dgraph.io/graphql](https://green-pine.us-east-1.aws.cloud.dgraph.io/graphql)

I expect only 2 results but it returns 4 results.

---

<div class="post-metadata">

**Author:** ![jdgamble555](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/jdgamble555/32/7503_2.png) [@jdgamble555](https://discuss.dgraph.io/u/jdgamble555)\
**Post date:** [July 4, 2021, 4:00pm UTC](https://discuss.dgraph.io/t/how-can-we-secure-the-graphql-api-from-malicious-queries-in-dgraph/14568/5 "2021-07-04T16:00:22Z")

</div>

I was able to reproduce this same error. I am wondering if you were recently upgraded from **20.11** , and if the upgrade caused the bug? Do you know by chance?

If so, then it may be a bug that needs to be reported in **21.03**.

J

---

<div class="post-metadata">

**Author:** ![pshaddel](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/pshaddel/32/11584_2.png) [@pshaddel](https://discuss.dgraph.io/u/pshaddel)\
**Post date:** [July 5, 2021, 8:52am UTC](https://discuss.dgraph.io/t/how-can-we-secure-the-graphql-api-from-malicious-queries-in-dgraph/14568/6 "2021-07-05T08:52:36Z")

</div>

I was testing it in dgraph cloud so I think this is because of the upgrade.

---

<div class="post-metadata">

**Author:** ![jdgamble555](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/jdgamble555/32/7503_2.png) [@jdgamble555](https://discuss.dgraph.io/u/jdgamble555)\
**Post date:** [July 31, 2021, 4:00am UTC](https://discuss.dgraph.io/t/how-can-we-secure-the-graphql-api-from-malicious-queries-in-dgraph/14568/7 "2021-07-31T04:00:42Z")

</div>

@MichelDiz - This is a **Bug** , should I create a new thread for this?

J

---

<div class="post-metadata">

**Author:** ![pshaddel](https://yyz1.discourse-cdn.com/flex007/user_avatar/discuss.dgraph.io/pshaddel/32/11584_2.png) [@pshaddel](https://discuss.dgraph.io/u/pshaddel)\
**Post date:** [July 31, 2021, 6:33am UTC](https://discuss.dgraph.io/t/how-can-we-secure-the-graphql-api-from-malicious-queries-in-dgraph/14568/8 "2021-07-31T06:33:19Z")

</div>

I created this after I realized this is a bug:

> **[Bug: Cannot limit number of results using auth directive to prevent malicious...](https://discuss.dgraph.io/t/bug-cannot-limit-number-of-results-using-auth-directive-to-prevent-malicious-queries/14828)**
>
> We are trying to prevent users from requesting too many documents by setting a big number in first argument. What edition and version of Dgraph are you using? v21.03.1 Have you tried reproducing the issue with the latest release? Yes, the bug...