devkral / graphene-protector Goto Github PK

relay is currently completely untested. Especially with connections there could be hidden problems

The documentation could be improved.

Especially the exposed DEFAULT_LIMITS should be explained.
It could be used as a base for new backends like for bottles or flask

It maybe would be nice to have backends for flask,...

Currently we parse the ast, but resource attacks can be executed earlier (when the ast is built)

Is there a way to get the input string first and analyze it?

Or are we able to limit the AST builder in such a way, it cannot be abused? Eg. the stack can be exhausted by high depths before any validation takes place

Hello! Thank you for such a useful project!

Integration with Django, which is described in the README file does not work for me, because Graphene-Django uses default backend instead of ProtectorBackend.

I fixed this by passing the backend as a view parameter.
path("graphql", csrf_exempt(GraphQLView.as_view(graphiql=True, backend=ProtectorBackend())))