Graphql: How to cancel a graphql query for protect DOS attack?

[orangeagain]

Rationale

Why should this feature exist?
Hackers could construct a huge query to block the service,We need to abort this query after it has taken a lot of time

What are the use-cases?
Both front-end, back-end and data analysts need graphql public services

Implementation

Do you have ideas regarding the implementation of this feature?
maybe use cancelable greenthread to limit task execution time and count cpu cost
Are you willing to implement this feature?
yes

[fjl]

This can be implemented by adding a context with timeout here:

go-ethereum/graphql/service.go

Lines 43 to 46 in a2b7481

	response := h.Schema.Exec(r.Context(), params.Query, params.OperationName, params.Variables)
	responseJSON, err := json.Marshal(response)
	if err != nil {

ctx, cancel = context.WithTimeout(r.Context(), 60 * time.Second)
defer cancel()

response := h.Schema.Exec(ctx, params.Query, params.OperationName, params.Variables)

[s1na]

@orangeagain You indicated you're willing to implement this feature. Can you please open a PR with the above solution?

[orangeagain]

@orangeagain You indicated you're willing to implement this feature. Can you please open a PR with the above solution?

I have no expirence on golang, and I am planning make a standalone graphql server by c#

[ahmetavc]

Hey @s1na, I opened a pr #26116 , added timeout as @fjl suggested. This is my first pr to geth repo. Thanks in advance.

[holiman]

Fixed by #26116