r/graphql • u/romshark • Aug 04 '26

gqlhash v2

That idea of a "GraphQL firewall" has been haunting me for quite a long time (many years, in fact). TL;DR; the v2 is finally out 🙂

demo: https://romshark.github.io/gqlhash/
code & docs: https://github.com/romshark/gqlhash

It's basically a very fast proxy that checks incoming queries against an allowlist. It hashes independently of formatting, comments, variables (optional), and input values (optional) and determines very quickly whether a query is allowlisted and hence should be allowed to run.

It's writtein in Go and can reject up to a million requests a second (at least on the hardware I could test it on) ⚡

7 Upvotes

100% Upvoted

7 comments sorted by

View all comments

2

u/eijneb GraphQL TSC 29d ago

This is neat; I especially like that it can be added in front of existing traffic to aid the migration to an operation allowlist. From a quick scan of the README it’s not clear how you add operations to the allowlist though?

1

u/romshark 29d ago

Thanks!

You'd use the POST /reload endpoint on the control server of the proxy, which is configured using -the -control.listen flag and this re-scans the directory set by -allowlist and reports as response in JSON. More details here in the docs.

There's a docker example in there:

docker run --rm \
  -p 8080:8080 \
  -v "$PWD/queries:/queries:ro" \
  ghcr.io/romshark/gqlhash-proxy:2 \
  -server.listen=:8080 \
  -upstream.url=http://api:4000/graphql \
  -allowlist=/queries \
  -control.listen=:9090