Proper way to address directive overloading vulnerability

[matthewsuan]

Hi, I just wanted to know what's the proper way to address directive overloading vulnerabilities for lighthouse graphql servers. It seems the Query complexity limit and query depth limit is not sufficient to address this issue.

Ty

[stayallive]

Can you explain this a bit more?

It seems the Query complexity limit and query depth limit is not sufficient to address this issue.

Why is complexity and query depth limiting not sufficient?

[matthewsuan]

Directive overloading does not count against the query complexity no matter how low you set the limit. I tried putting the query complexity limit to 10 and tried directive overloading with 500 directives and its not triggering the query complexity limit error.

[spawnia]

That is expected, because that is not what query complexity analysis does. Given you set reasonable limits on the maximum request body size and limit the amount of memory and execution time per PHP request, I don't see how this can be considered a vulnerability.