Learn how to write highly concurrent programs in Go using goroutines, channels and select keyword. In this article, we'll explore the basics of concurrent programming in Go and dive into the details of using goroutines, channels and select keyword to implement concurrency. We'll cover the syntax and usage of these essential tools. By the end of this article, you'll have a basic foundation for building scalable and efficient concurrent programs in Go


In my journey to becoming proficient in <Text.Link text={"Go"} href={"https://en.wikipedia.org/wiki/Go_(programming_language)"} target={"\_blank"} showExtIcon={true} />(Golang as I prefer to call it), I came across the concepts of Goroutines, Channels and the Select keyword which enabled <Text.Link text={"concurrent programming"} href={"https://en.wikipedia.org/wiki/Concurrent_computing"} target={"\_blank"} showExtIcon={true} /> in Go. While these concepts might seem a bit intimidating at first, I found them to be incredibly powerful and intuitive once I got the hang of them.

In this article, I’ll be sharing what I’ve learned about `Goroutines`, `Channels` and the `Select Keyword` which are the main features that are the backbone of concurrency in Go, and how they can be used to write efficient and concurrent programs.

## What is Concurrent Programming?

Concurrent programming is the ability to execute multiple tasks simultaneously. This differs from sequential programming, where tasks are executed one after the other. In Go, concurrent programming is made possible through the use of Goroutines, Channels and the Select Keyword.

Before we dive into the fun stuff 😁, I'll like to define some terms used frequently in this article:

- **Process** is an instance of a program that's being run by a computer's operating system. Each process is assigned resources (e.g. memory) and the OS makes sure other processes can't access them. A process is made up of one or more threads.

- **Thread** is a unit of execution that's given some time to run by the OS. threads within a process share access to resources. the computer's <Text.Link text={"C.P.U"} href={"https://en.wikipedia.org/wiki/Central_processing_unit"} target={"\_blank"} showExtIcon={true} /> can execute instructions from one or more threads at the same time depending on the number of cores on the computer.

- **Zero Value** refers to the default value assigned to a variable of a certain type when it is declared but not initialized explicitly.

## Goroutines

These are lightweight processes that are managed by the Go runtime. when a Go program starts, the Go runtime creates some threads and launches a single Goroutine to start execution. All Goroutines launched by your program are automatically assigned to these threads by the <Text.Link text={"Go Runtime Scheduler"} href={"https://www.developer.com/languages/go-scheduler/#:~:text=In%20Go%20and%20Golang%20programming,in%20the%20most%20efficient%20way."} target={"\_blank"} showExtIcon={true} />, just like how OS schedules threads across C.P.U cores.

Some of the advantages that allow a Go program to launch, hundreds, thousands and even hundreds of thousands of Goroutines are:

- Goroutine creation is faster than OS threads because they aren't an OS level thread resource.
- Goroutine's initial stack size is smaller than OS thread stack size, making them more memory efficient.
- Goroutine switching is faster than OS thread switching because it happens entirely within the process.
- Go's Runtime Scheduler can optimize its decision because it's part of the Go process.

A Goroutine is launched by placing the `go` keyword before a function invocation. you can pass it arguments to initialize its state, however, any return value is ignored. **Any function can be launched as a Goroutine**.

```go showLineNumbers
package main

import (
    "fmt"
    "time"
)

func main() {
    go count("sheep")
    go count("goats")
    time.Sleep(time.Second * 2)
}

func count(animal string) {
    for i := 1; i <= 5; i++ {
        fmt.Println(i, animal)
        time.Sleep(time.Millisecond * 500)
    }
}
```

In this example, we create two Goroutines that both call the `count` function with different animals as arguments. The `count` function simply prints out the animal and a number from 1 to 5, pausing for half a second between each print statement.

The `main` function waits for two seconds using the `time.Sleep` function to allow both Goroutines to finish executing before the program exits.

## Channels

Channels are used to communicate and synchronize data between Goroutines. Channels are built-in types in Go just like `slices` and `maps`, They provide a way for one Goroutine to send a value to another Goroutine. few notes you should keep in mind about Channels are:-

- The `zero value` for a Channel is `nil`.
- Channels are created using the built-in `make` function.
- Channels are reference types. when you pass them to functions, you're passing a pointer to the Channel.

To create a new Channel in Go, we use the `make` function and specify the type of data that the Channel will transmit. Here's an example:

```go
myChannel := make(chan int)
```

### Reading & Writing

We use the `<-` operator to interact with a Channel, you read from a Channel by placing the operator before the Channel (`<- Channel`), and you write to a Channel by placing the operator after the Channel (`Channel <- value`).

Each value written to a Channel can only be read once. if multiple go routines are reading from a single Channel, the value will only be read by one of them (avoid this pattern).

```go showLineNumbers
// Note, Goroutine execution pauses after the write operation, the following is for demo purposes only

myChannel <- chanValue * 20 // writes to a Channel
chanValue := <- myChannel // reads from the Channel & assigns the value to a variable
```

### <Text.Link text={"Channel Buffering"} href={"https://medium.com/a-journey-with-go/go-buffered-and-unbuffered-Channels-29a107c00268"} target={"\_blank"} showExtIcon={true} />

Channels are Unbuffered by default in Go. every write to an open, Unbuffered Channel causes the Goroutine to pause until another Goroutine reads from that Channel, likewise, every read from an open, Unbuffered Channel pauses until another Goroutine writes to it.

Channels can also be buffered in Go. these are Channels with many elements(values). writing to an open, buffered Channel works without blocking, if the Channel fills up before another Goroutine reads from the Channel, subsequent writes to the Channel block until another Goroutine reads from the Channel. Also reading from empty buffered Channel blocks.

You create a buffered Channel the same way for Unbuffered, just with the addition of a `capacity`(the max buffer size) you can use the built-in functions `len` and `cap` for interacting with Channels

```go showLineNumbers
package main

func main() {
    myBufferedChannel := make(chan int, 10) // buffered Channel with buffer size of 10 element

    ChannelLength := len(myBufferedChannel) // returns the number of values currently in the Channel
    ChannelCapacity := cap(myBufferedChannel) // returns the Channel max buffer size
}
```

## Select Keyword

The `select` keyword is another powerful tool for managing concurrent programming in Go, This is basically the control structure for concurrency in Go. It allows a Goroutine to read from or write to a set of multiple Goroutines.

The syntax for using `select` is similar to a `switch` statement, with each `case` representing a Channel operation. When a Channel operation is ready to be executed, the corresponding `case` is selected and the associated block of code is executed.

Each `case` in a `select` is a read or write to a Channel, if a read or write is possible, it is executed along with the body of the case. The select cases are all checked at the same time whether they can be written to or read from. it picks randomly from any of its cases that can go forward, order is unimportant. this solves <Text.Link text={"starvation"} href={"https://en.wikipedia.org/wiki/Starvation_(computer_science)"} target={"\_blank"} showExtIcon={true} />(no case is favored over another) and <Text.Link text={"deadlocks"} href={"https://en.wikipedia.org/wiki/Deadlock"} target={"\_blank"} showExtIcon={true} />.

`select` statements can also have default `cases`, it runs when no Channel can be read from or written to. it makes the select run immediately and not wait for a read or write

```go showLineNumbers
select {
case v := <-myChannel:
    fmt.Println(v)

case myChannel <- someValue:
    fmt.Println("wrote to myChannel", someValue)

case <-someChannel:
    fmt.Println("read from someChannel, but ignored the value returned")
}
```

since `select` is responsible for communicating over a number of Channels, it is often wrapped inside an infinite loop.

```go showLineNumbers
for {
    select {
    case <- done:
        return

    case val := <-Channel:
        fmt.Println(val)
    }
}
```

Having a default `case` inside a `for-select` loop would be triggered in every iteration, causing the for loop to run constantly, putting the C.P.U to lots of unnecessary work.

```go showLineNumbers
for {
    select {
    case <- done:
        return

    case val := <-Channel:
        fmt.Println(val)

    default:
        fmt.Println("select didn't wait for any of read or write case")
    }
}
```

The `select` statement is a powerful tool for managing concurrent programming in Go and can be used in a wide variety of scenarios. With this tool in your arsenal, you'll be able to create highly performant, scalable, and concurrent programs in Go.

## Conclusion

Goroutines and Channels are powerful tools for concurrent programming in Go. With Goroutines, we can execute multiple functions concurrently without worrying about thread overhead, while Channels provide a safe and efficient way for Goroutines to communicate and synchronize data.

In this guide, we've explored the basics of Goroutines and Channels in Go and provided some examples to help you get started. With these tools in your toolkit, you can build fast and efficient concurrent applications in Go.

To learn more about Go's concurrency features, I recommend checking out the following resources:

- <Text.Link
    text={"The official Go documentation on Goroutines"}
    href={"https://golang.org/doc/effective_go#Goroutines"}
    target={"_blank"}
    showExtIcon={true}
  />
- <Text.Link
    text={"The official Go documentation on Channels"}
    href={"https://golang.org/doc/effective_go#Channels"}
    target={"_blank"}
    showExtIcon={true}
  />
- <Text.Link
    text={'"Learning Go" chapter 10, by Jon Bodner'}
    href={"https://www.oreilly.com/library/view/learning-go/9781492077206"}
    target={"_blank"}
    showExtIcon={true}
  />


Concurrent Programming in Go: An Introduction to Goroutines and Channels

Discover how to integrate C code into your Go projects with ease using Cgo. In this article, we'll explore the basics of using Cgo to seamlessly incorporate C code into your Go programs. We'll cover the syntax and usage of Cgo, as well as some common scenarios where it can be particularly useful. By the end of this article, you'll have a solid understanding of how to properly leverage this powerful tool to extend the functionality of your Go applications with C libraries.


Are you a <Text.Link text={ "Go" } href={ "https://en.wikipedia.org/wiki/Go_(programming_language)" } target={ "\_blank" } showExtIcon={ true } /> developer looking to leverage the power of <Text.Link text={ "C" } href={ "https://en.wikipedia.org/wiki/The_C_Programming_Language" } target={ "\_blank" } showExtIcon={ true } /> libraries in your project? Enter Cgo, the bridge between Go and C. With Cgo, you can seamlessly integrate C code into your Go project without sacrificing the performance and efficiency of the Go language.

In this article, we'll walk through the basics of using Cgo in Go, and show you how to integrate C code into your project with ease. So, let's get started!

## What is Cgo?

Most, if not all major <Text.Link text={ "Operating Systems" } href={ "https://www.techtarget.com/whatis/definition/operating-system-OS" } target={ "\_blank" } showExtIcon={ true } /> are primarily written in C despite being 50+ years old, which means these Operating Systems are bundled with libraries written in C, this also means that most programming languages that run on these Operating Systems provide a way to enable inter-language calls with these C libraries. Go refers to its <Text.Link text={ "FFI (foreign function interface)" } href={ "https://en.wikipedia.org/wiki/Foreign_function_interface" } target={ "\_blank" } showExtIcon={ true } /> to C as `Cgo`.

Cgo is a powerful tool that allows developers to call C functions from Go code. It achieves this by generating Go wrapper code that interfaces with the C code. This allows you to use existing C code and libraries in your Go project, without having to rewrite everything in Go.

## Why use Cgo?

Before we dive in further, I'll like to break it to you that **Cgo isn't fast** because if you're like me you might be thinking of rewriting some performance-critical parts of your existing Go code in C but it's very unlikely you'll make your code faster using Cgo.

There are several reasons why you might want to use Cgo in your Go project, Unfortunately, Additional performance gain isn't one of them. Due to the mismatches in the processing and memory models, calling a C function from Go is about `29` times slower than a C function calling another C function. Below are two reasons to use Cgo:

- You need to call C code with no suitable replacement that is available in Go.
- You want to take advantage of C libraries that are more mature or perform better than their Go counterparts.

While using Cgo does come with some overhead, such as the need to manage memory allocation manually, the benefits can outweigh the costs in many cases.

## Getting Started with Cgo

To get started with Cgo, you need to have a basic understanding of Go and C. You'll also need a C compiler installed on your system, A quick Google search should get you started on the OS of your choice if you don't have one installed already.

Let's start by writing a simple C function that we can call from Go. Create a new file called `hello.c` and add the following code:

```c:hello.c showLineNumbers
#include <stdio.h>

void say_hello() {
    printf("Hello from C!\n");
}
```

This function simply prints out "Hello from C!" to the console.

Next, we'll create a Go file that calls this C function using Cgo. Create a new file called `main.go` and add the following code:

```go:main.go showLineNumbers
package main

// #include "hello.c"
import "C"

func main() {
    C.say_hello()
}
```

The import "C" line tells Go that we'll be using Cgo in this file. We then call our `say_hello` function from C using the `C` prefix.

Now, let's run our program:

```bash
go run main.go
# Hello from C!
```

And just like that, we've successfully called a C function from Go using Cgo!

You might be wondering, what's going on? There isn't an actual package named `C` in the standard library, `C` is an automatically generated package whose identifiers come from the C code in the comments that immediately precede it. so if you declare a C function named `hello`, Cgo makes it available in your Go program as `C.hello`. you could also invoke functions, and reference global variables that are imported into the comment block from C libraries via header files, you just have to make sure the file is in the same directory as your Go code.

## Memory Management with Cgo

One of the key differences between Go and C is the way they handle memory management. Go uses a garbage collector to automatically manage memory, while C requires manual memory management and this makes it difficult to integrate non-trivial Go code with C.

When using Cgo, it's important to keep this in mind. Any memory allocated in C code must be freed manually to prevent memory leaks.

Let's modify our `hello.c` file to allocate memory using `malloc`, and then free it using `free`. Replace the contents of `hello.c` with the following code:

```c:hello.c showLineNumbers
#include <stdlib.h>
#include <stdio.h>

char* get_hello() {
    char* str = malloc(15 * sizeof(char));
    sprintf(str, "Hello from C!");
    return str;
}

void free_hello(char* str) {
    free(str);
}
```

This new `get_hello` function allocates memory using malloc and returns a pointer to the string "Hello from C!". We also added a new `free_hello` function that frees the memory allocated by `get_hello`.

Now, let's modify our `main.go` file to call these new functions:

```go:main.go showLineNumbers
package main

// #include <stdlib.h>
// #include "hello.c"
import "C"
import "fmt"

func main() {
    str := C.GoString(C.get_hello())
    defer C.free(unsafe.Pointer(str))
    fmt.Println(str)
}
```

We've added the `stdlib.h` header file to use malloc and free functions in Go. In our Go code, we now use the `C.GoString` function to convert the C string returned by `get_hello` to a Go string. We also added a defer statement to ensure that we call `C.free` to free the memory allocated by the C `get_hello` function.

Now, when we run our program, we should see "Hello from C!" printed on the console, with no memory leaks!

## Advanced Cgo Techniques

Cgo is a powerful tool that offers many advanced features, such as the ability to pass Go slices and maps to C functions. However, these advanced features come with some complexity and performance overhead, so use them judiciously.

To learn more about using Cgo in Go, check out the official documentation:-

- <Text.Link
    text={"Learning Go (by Jon Bodner, chapter 14)"}
    href={"https://www.oreilly.com/library/view/learning-go/9781492077206/"}
    target={"_blank"}
    showExtIcon={true}
  />
- <Text.Link
    text={"Cgo - The Go Programming Language"}
    href={"https://golang.org/cmd/cgo/"}
    target={"_blank"}
    showExtIcon={true}
  />
- <Text.Link
    text={"When and How to use CGo"}
    href={"https://www.youtube.com/watch?v=qvVyT9QjIqc"}
    target={"_blank"}
    showExtIcon={true}
  />

## Conclusion

Cgo is a powerful tool that allows developers to seamlessly integrate C code into their Go projects. With a little bit of knowledge and care, you can take advantage of existing C libraries and code in your Go projects, without sacrificing the performance and efficiency of the Go language.

Now, go forth and Cgo!


Seamlessly Integrating C Code into Your Go Projects with Cgo

Discover best practices and strategies for mitigating resource-exhaustion attacks (DDoS) on GraphQL APIs. In this article, we'll explore the impact of resource-exhaustion attacks on GraphQL API performance and provide effective solutions to safeguard your APIs. Learn how to implement query depth limits, use query complexity analysis, and apply rate limiting techniques to protect your GraphQL endpoints. By the end of this article, you'll have a comprehensive understanding of how to fortify your GraphQL APIs against resource-exhaustion attacks, ensuring optimal performance and availability.


Over the past few years, GraphQL has become more popular as a way to build APIs, it's important to understand the potential security risks that come with it. One of the most common and devastating attacks or security threats that GraphQL APIs face is resource-exhaustion attacks, which are a type of <Text.Link href={ "https://www.cloudflare.com/en-gb/learning/ddos/what-is-a-ddos-attack/" } text={ "Distributed Denial of Service (DDoS)" } target={ "\_blank" } showExtIcon={ true } /> attacks. This type of attack floods your GraphQl API server with overly complex queries that overwhelm its resources, making it unresponsive and unable the complete the usual request-response lifecycle to genuine users.

In this article, we'll focus on some best practices and strategies to mitigate resource-exhaustion attacks specifically on GraphQl APIs. But before we dive into the solutions, let's first take a closer look at what resource-exhaustion attacks are and how they affect Graphql APIs.

## What are Resource-Exhaustion Attacks and How Do They Impact GraphQL API's Performance?

Resource-exhaustion attacks are a type of `DDoS` attack that aims to exhaust the resources of a server by overwhelming it with a high volume of requests. In the case of GraphQL APIs, these attacks take many forms but they typically involve sending overly complex queries or mutations with circular dependencies that are computationally expensive, consuming a significant amount of the server's processing power. These queries can put a significant amount of strain on your server's resources, causing it to become unresponsive to legitimate users or even crash in some occurrences.

One of the main challenges of mitigating resource-exhaustion attacks on GraphQL APIs is that they don't fit the traditional pattern of flooding a server with a high volume of requests. Instead, the attack is more subtle and involves sending a small number of large, overly complex queries. This makes it harder to detect and mitigate the attack.

Now, let's take a look at some code examples to better understand how this attack can affect a GraphQL API server, In these examples, I'll be making use of <Text.Link href={ "https://www.postman.com/" } text={ "Postman" } target={ "\_blank" } showExtIcon={ true } /> but you can equally use <Text.Link href={ "https://www.apollographql.com/" } text={ "Apollo's" } target={ "\_blank" } showExtIcon={ true } /> GraphIQL Playground (an interactive, in-browser GraphQl IDE) for sending the Graphql queries (just go to this <Text.Link href={ "http://localhost:4000/" } text={ "URL" } target={ "\_blank" } showExtIcon={ true } /> that the server is listening on in your browser). To follow along with the code examples in this article, clone the GitHub repository <Text.Link href={ "https://github.com/huboh/graphql-resource-exhaustion-attack" } text={ "here" } target={ "\_blank" } showExtIcon={ true } /> and follow the instructions in the repo's <Text.Link href={ "https://github.com/huboh/graphql-resource-exhaustion-attack#readme" } text={ "Readme" } target={ "\_blank" } showExtIcon={ true } />.

The code block below showcases our GraphQL schema alongside all available queries that client applications can send. A blog Post has an author, and an author which is a User object has many Posts (One-To-Many relationship). If an attacker sends a query to our GraphQl API for a User, which in turn requires 50 or even 100s of his/her Posts, which then requires the author for each Post, which in turn require his/her Posts again, the server will be stuck in an infinite loop, consuming a significant amount of it's processing power while other requests from genuine users are pending.

```graphql:/graphql/schema.graphql showLineNumbers
type User {
  id: ID!
  role: Role!
  name: String
  email: String!
  posts: [Post!]!
  createdAt: Date!
  updatedAt: Date!
}

type Post {
  id: ID!
  title: String!
  author: User!
  content: String!
  createdAt: Date!
  updatedAt: Date!
  publishedAt: Date!
  isPublished: Boolean!
}

type Query {
  me: User
  user(userId: ID): User
  post(userId: ID): Post
}
```

Now we're going to demonstrate the effects of resource-exhaustion attacks, Open two request tabs on `Postman` or `Apollo's` GraphIQl Playground. Moving forward, I'll be using Postman for the examples not just because I have a preference for it or because I think it's faster 👀. In the first tab, we're going to be simulating a genuine user while on the second tab, we'll be simulating a bad actor.

<Image.Article
  alt="screenshot of two opened request tab on postman for graphql queries"
  src="/assets/images/articles/Mitigating-Resource-Exhaustion-Attacks-(DDoS)-on-GraphQL-APIs-Best-Practices-and-Strategies/query-tabs.png"
  width={870}
  height={89}
/>

- In the first tab, we'll be sending the `me` query below to get the current user's information whose context we're running the queries for, together with 10 of their posts. Note that this query has an average response time of just `5ms`.

```graphql showLineNumbers
query CurrentUser($filter: UserPostsFilterInput) {
  me {
    id
    role
    name
    email
    createdAt
    updatedAt
    posts(filter: $filter) {
      id
      title
      isPublished
      updatedAt
      createdAt
      publishedAt
    }
  }
}
```

GraphQl query variables for the `me` query above.

```json showLineNumbers
{
  "filter": {
    "postCount": 10
  }
}
```

- In the second tab, we'll be sending the complex query below which has lots of circular dependencies. sending this query, you'll notice it takes a significant amount of time to get a response from the server if at all it doesn't even crash the request tab or the whole application. Now head back to the first tab(genuine user tab) and send off the request again with the second tab pending a response from the server in the background, you'll notice that the `me` query that has an average response time of `5 milliseconds` has dramatically increased to an average response time of `1 minute 10 seconds`.

```graphql showLineNumbers
query Complex {
  user {
    id
    role
    name
    email
    createdAt
    updatedAt
    posts {
      id
      title
      content
      isPublished
      updatedAt
      createdAt
      publishedAt
      author {
        id
        role
        name
        email
        createdAt
        updatedAt
        posts {
          id
          title
          content
          isPublished
          updatedAt
          createdAt
          publishedAt
          author {
            id
            role
            name
            email
            createdAt
            updatedAt
            posts {
              id
              title
              content
              isPublished
              updatedAt
              createdAt
              publishedAt
              author {
                id
                role
                name
                email
                createdAt
                updatedAt
              }
            }
          }
        }
      }
    }
  }
}
```

<Image.Article
  alt="significant increase in response time for the me graphql query"
  src="/assets/images/articles/Mitigating-Resource-Exhaustion-Attacks-(DDoS)-on-GraphQL-APIs-Best-Practices-and-Strategies/me-query-2.jpg"
  width={1255}
  height={622}
/>

This query is designed to fetch a lot of data from the server, including lots of the current user posts and the author of those posts. If an attacker were to send a flood of queries like this to your GraphQL server, it could quickly consume all of your server's resources and cause it to become unresponsive.

Of course, this is just a simple example. In a real-world scenario, the attacker might use a more sophisticated method to overwhelm your server. But the basic principle is the same: the attacker is trying to consume all of your server's resources to prevent legitimate users from accessing your service.

## Solutions

To mitigate resource-exhaustion attacks on your GraphQL API, you can implement the following best practices and strategies:

- Request Timeouts
- Query Depth Limits
- Cost Analysis on the Query
- Allowing Only Pre-Approved Queries

### Implement Query Depth Limits

One way to prevent resource-exhaustion attacks is to implement query depth limits. This means that you set a limit on how deep the queries client applications send can go so that they can't fetch an unlimited amount of data from your server.

To implement query depth limits on your GraphQL API server with `NodeJs`, install the `graphql-depth-limit` package from npm. This package allows you to set a maximum depth for your GraphQL queries so that any queries that go deeper than the limit will be rejected.

You can view the complete source code for this example in the <Text.Link href={ "https://github.com/huboh/graphql-resource-exhaustion-attack/tree/query-depth-limit-example" } text={ "query-depth-limit-example" } target={ "\_blank" } showExtIcon={ true } /> branch.

```ts:/src/index.ts showLineNumbers
...
import { ApolloServer } from '@apollo/server';
import { default as depthLimit } from "graphql-depth-limit";

const port = 4000;
const server = new ApolloServer({
  typeDefs,
  resolvers,
  introspection: true,
  validationRules: [
    depthLimit(5)
  ]
});
...
```

Setting The depth limit of 5 for our queries means that any query that goes deeper than 5 levels will be rejected.

<Image.Article
  alt="graphql query that exceeds the maximum query depth rule of 5 set by the server"
  src="/assets/images/articles/Mitigating-Resource-Exhaustion-Attacks-(DDoS)-on-GraphQL-APIs-Best-Practices-and-Strategies/query-depth-limit-example.jpg"
  width={1234}
  height={606}
/>

### Use Query Complexity Analysis

Another strategy for mitigating resource-exhaustion attacks is to use query complexity analysis. This means that you analyze each GraphQL query that comes into your server and assign it a complexity score based on factors like the number of fields being requested, the depth of the query, and the number of variables being used. This is somewhat similar to the `query-depth-limit` strategy.

To implement query complexity analysis on your GraphQL API server with `NodeJs`, you can use an npm package like `graphql-query-complexity`. This package allows you to set a maximum complexity for your GraphQL queries so that any queries that exceed the limit will be rejected. Below is an example of how you can use `graphql-query-complexity` on your GraphQL API server:

You can view the complete source code for this example in the <Text.Link href={ "https://github.com/huboh/graphql-resource-exhaustion-attack/tree/query-cost-complexity-example" } text={ "query-cost-complexity" } target={ "\_blank" } showExtIcon={ true } /> branch.

```ts:/src/index.ts showLineNumbers
...
import { ApolloServer } from '@apollo/server';
...
import { createComplexityRule, simpleEstimator } from 'graphql-query-complexity';

const port = 4000;
const server = new ApolloServer({
  typeDefs,
  resolvers,
  introspection: true,
  validationRules: [
    createComplexityRule({
      maximumComplexity: 50,
      estimators: [
        simpleEstimator({
          defaultComplexity: 1
        })
      ]
    })
  ]
});
...
```

In this example we're using the `graphql-query-complexity` package from npm to set a maximum complexity score of `50` for our queries, in a real-world scenario you would use a higher figure but for this example, `50` is a perfect figure. Any queries that exceed this limit will be rejected.

<Image.Article
  alt="graphql query that exceeds the maximum complexity value rule of 50 set by the server"
  src="/assets/images/articles/Mitigating-Resource-Exhaustion-Attacks-(DDoS)-on-GraphQL-APIs-Best-Practices-and-Strategies/query-complexity-example.jpg"
  width={1227}
  height={606}
/>

### Allowing Only Pre-Approved Queries

This strategy works best if the GraphQl API you're trying to protect is designed for internal use by your client applications and not for public consumption. Going with this strategy, you'll have an `approved-list` approach that lists all of the allowed queries your server is allowed to execute. This approach re-introduces some dependencies between the client and the server, some automation strategy can be used to mitigate against this issue.

You can view the complete source code for this example in the <Text.Link href={ "https://github.com/huboh/graphql-resource-exhaustion-attack/tree/pre-approved-queries-example" } text={ "pre-approved-queries-example" } target={ "\_blank" } showExtIcon={ true } /> branch.

Here's an example of how you can allow only pre-approved queries to run in your GraphQL API server:

```ts:/src/index.ts showLineNumbers
...
import stringSimilarity from "string-similarity";
import { print } from "graphql/language";
import { ApolloServer } from '@apollo/server';
...

const approvedQueries = [
  `query CurrentUser($filter: UserPostsFilterInput) {
    me {
      ...
    }
  }`
];

const port = 4000;
const server = new ApolloServer({
  typeDefs,
  resolvers,
  introspection: true,
  plugins: [
    {
      requestDidStart: async () => ({
        didResolveOperation: async ({ request, document }) => {
          const query = print(document);
          const operation = request.operationName || (document.definitions[0] as any).name?.value || 'unknown';

          // It's possible that the queries are not identical due to differences in whitespace,
          // comments, or other characters. Hence the use of `string-similarity` package
          if (stringSimilarity.findBestMatch(query, approvedQueries).bestMatch.rating < 0.8) {
            throw new Error(`Query "${operation}" not approved.`);
          }
        }
      }),
    }
  ]
});
...
```

In this example, we're using the `print` function from the `graphql` package to get a string representation of the `AST` node. Then we use the `string-similarity` to score similarity between strings because of possible differences in whitespace, comments etc.

<Image.Article
  alt="an unknown graphql query not found in an approved-list of queries rejected by the api server on postman"
  src="/assets/images/articles/Mitigating-Resource-Exhaustion-Attacks-(DDoS)-on-GraphQL-APIs-Best-Practices-and-Strategies/pre-approved-query-example.jpg"
  width={1077}
  height={474}
/>

## Conclusion

In this article, we've seen how Resource-exhaustion attacks can significantly impact the performance of your GraphQL API and cause your application to become unresponsive or even crash. To mitigate these attacks, you can implement query depth limits, use query complexity analysis, and rate limit your GraphQL endpoint. These best practices and strategies can help keep your GraphQL API running smoothly and protect it from potential security threats.


Mitigating Resource-Exhaustion Attacks (DDoS) on GraphQL APIs: Best Practices and Strategies

Noteway is a collaborative note-taking/article-writing web app, i like to think of it as "a mesh of Google Keep & Google Docs" with a nice UI of course. individuals or teams can sync, organize & retrieve notes or tasks across multiple devices, share ideas & lots more. (in development).

Noteway

A light weight & blazingly fast😁 Go package that uses reflection under the hood to marshal & un-marshal CSV records(slice of slice of strings) to/from CSV entries(slice of struct).

Records: Golang CSV Data Marshaler

A b2c e-commerce web app for sneakers, clothing accessories & more. built with basic functionalities like tracking/syncing user cart on multiple devices, get personalized recommendation on products e.t.c.

I build enterprise ready applications for the web

about me

some of my recent projects

Noteway

Records: Golang CSV Data Marshaler

Aora

get in touch!