https://github.com/ldebruijn/graphql-protect
A dead-simple yet highly customizable security proxy compatible with any HTTP GraphQL Server or Gateway.
https://github.com/ldebruijn/graphql-protect
go golang graphql security
Last synced: 12 months ago
JSON representation
A dead-simple yet highly customizable security proxy compatible with any HTTP GraphQL Server or Gateway.
- Host: GitHub
- URL: https://github.com/ldebruijn/graphql-protect
- Owner: ldebruijn
- License: mit
- Created: 2023-09-24T09:56:11.000Z (almost 3 years ago)
- Default Branch: main
- Last Pushed: 2025-05-27T19:59:18.000Z (about 1 year ago)
- Last Synced: 2025-05-27T20:43:33.314Z (about 1 year ago)
- Topics: go, golang, graphql, security
- Language: Go
- Homepage:
- Size: 873 KB
- Stars: 31
- Watchers: 2
- Forks: 5
- Open Issues: 1
-
Metadata Files:
- Readme: README.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
- Codeowners: .github/CODEOWNERS
Awesome Lists containing this project
- awesome - ldebruijn/graphql-protect - A dead-simple yet highly customizable security proxy compatible with any HTTP GraphQL Server or Gateway. (<a name="Go"></a>Go)
README
# GraphQL Protect 🛡️
GraphQL Protect is dead-simple yet highly customizable security proxy compatible with any HTTP GraphQL Server or Gateway.
[](https://github.com/ldebruijn/graphql-protect/actions/workflows/go.yml)
[](https://github.com/ldebruijn/graphql-protect?tab=MIT-1-ov-file)
_This repository is inspired by the great work of the Javascript [GraphQL Armor](https://github.com/Escape-Technologies/graphql-armor) middleware._
## Features
* [Trusted Documents (Persisted Operations)](docs/protections/trusted_documents.md)
* [Block Field Suggestions](docs/protections/block_field_suggestions.md)
* [Obfuscate upstream errors](docs/protections/obfuscate_upstream_errors.md)
* [Max Aliases](docs/protections/max_aliases.md)
* [Max Tokens](docs/protections/max_tokens.md)
* [Max (Field & List) Depth](docs/protections/max_depth.md)
* [Max Batch](docs/protections/max_batch.md)
* [Enforce POST](docs/protections/enforce_post.md)
* [Access Logging](docs/protections/access_logging.md)
* _Max Directives (coming soon)_
* _Cost Limit (coming soon)_
Curious why you need these features? Check out this [Excellent talk on GraphQL security](https://www.youtube.com/watch?v=hyB2UKsEkqA&list=PLP1igyLx8foE9SlDLI1Vtlshcon5r1jMJ) on YouTube.
## Installation
### As Container
```shell
docker pull ghcr.io/ldebruijn/graphql-protect:latest
docker run -p 8080:8080 -v $(pwd)/protect.yml:/app/protect.yml -v $(pwd)/schema.graphql:/app/schema.graphql ghcr.io/ldebruijn/graphql-protect:latest
```
Make sure to portforward the right ports for your supplied configuration
Check out our [run documentation](docs/README.md#run) for more concrete examples.
### Source code
```shell
git clone git@github.com:ldebruijn/graphql-protect.git
```
Build & Test
```shell
make build
make test
```
Run Container
```shell
make run_container
```
## Documentation
Check out our extensive documentation, including configuration examples, detailed descriptions of each protection feature as well as deployment configuration examples.
[Documentation](docs/README.md)
## Configuration
We recommend configuring the binary using a yaml file, place a file called `protect.yml` in the same directory as you're running the binary.
For all the configuration options check out the [Configuration Documentation](docs/configuration.md)
## Spec Target
At time of writing, GraphQL Protect targets the [October 2021](https://spec.graphql.org/October2021/) version of the GraphQL specification and [select portions of the Draft](https://spec.graphql.org/draft/).
## Contributing
Ensure you have read the [Contributing Guide](https://github.com/ldebruijn/graphql-protect/blob/main/CONTRIBUTING.md) before contributing.
To set up your project, make sure you run the `make dev.setup` script.
```bash
git clone git@github.com:ldebruijn/graphql-protect.git
cd graphql-protect
make dev.setup
```
## Known Limitations
Check out [known limitations](docs/README.md#known-limitations) for more details.