What's the best way to rate limit specific graphql endpoints?

[charlesverdad]

Is there a way to limit graphql endpoints? What are the current workarounds for this?

As a feature request, it might be a good idea to have something like https://django-ratelimit.readthedocs.io/en/v1.0.0/, where you can use decorators to ratelimit your APIs.

[zbyte64]

Why not just use django-ratelimit? You can use the graphql endpoint with decorators, this is how I did it with csrf exemption:

url(r'^graphql/$', csrf_exempt(GraphQLView.as_view(graphiql=True))),

[charlesverdad]

Hi @zbyte64 haven't tried it yet but doesn't that require a view class though? I was hoping I could do it on a per-mutation/query basis. i.e., I want to limit only my graphql/signup endpoint and not all graphql endpoints.

[zbyte64]

I see, in that case you would embed the is_ratelmited call in each mutation or resolver: https://django-ratelimit.readthedocs.io/en/v1.0.0/usage.html#is_ratelimited ; where info.context is the request object the function needs

[japrogramer]

hmm, one solution could be a decorator that gets the class and resolver function
than uses that as a key with the users pk
in redis with an auto expire provision ..

[o3o3o]

This snippet may help you

[o3o3o]

I wrote a simple tool: https://pypi.org/project/django-graphql-ratelimit/