Why does Membrane API Gateway return GraphQL protection violation?

The graphQLProtection plugin rejected a GraphQL-over-HTTP request: the method is not allowed (405), the request cannot be parsed (422), or the query breaks a limit or the blocklist (400).

How do I allow deeper GraphQL queries in Membrane?

Raise maxDepth, maxRecursion or maxMutations on the graphQLProtection plugin. The detail of the error response names the limit that was exceeded.

How do I hide the details in Membrane error responses?

Enable production mode by adding a configuration document with production: true to your apis.yaml. Membrane then leaves out detailed information from error responses.

GraphQL Protection Violation

Membrane API Gateway links to this page with the title GraphQL protection violation when the graphQLProtection plugin rejects a GraphQL-over-HTTP request in the request flow. The request does not reach the GraphQL backend.

The Error Response

The response contains the title GraphQL protection violation, a detail that names the violation, the problem type https://membrane-api.io/problems/user and a link to this page. The type user means that the request caused the problem. The status depends on the kind of violation, as described below.

What GraphQL Protection Does

The graphQLProtection plugin checks GraphQL requests before they reach the backend and reduces the attack surface of the API. It limits the depth, recursion and number of mutations of a query, and can forbid introspection, subscriptions and mutations. See GraphQL Protection for an introduction.

api:
  port: 2000
  flow:
    - graphQLProtection:
        maxDepth: 7
        maxRecursion: 1
        maxMutations: 5
  target:
    url: https://www.predic8.de/fruit-shop-graphql

api:
  port: 2000
  flow:
    - graphQLProtection:
        maxDepth: 7
        maxRecursion: 1
        maxMutations: 5
  target:
    url: https://www.predic8.de/fruit-shop-graphql

Common Causes

405 Method Not Allowed: The Method Is Not Allowed

The HTTP method is not in allowedMethods, which defaults to GET, POST. Also, GET is only allowed for queries; mutations and subscriptions must be sent with POST.

422 Unprocessable Content: The Request Cannot Be Parsed

The request is malformed: Content-Type is missing, duplicated or not application/json or application/graphql; the charset is not UTF-8; query is missing or not a string; operationName is not a string; variables or extensions is not a JSON object; the query string or body cannot be decoded; or the GraphQL document has a syntax error.

400 Bad Request: The Document Is Invalid

The operation named by operationName is not in the document, the document contains no operation, or it has duplicate operation names or other duplicate global names.

400 Bad Request: A Limit Was Exceeded

The query is nested deeper than maxDepth, recurses more than maxRecursion, or defines more mutations than maxMutations. Or it uses extensions while allowExtensions is false.

400 Bad Request: A Feature Is Forbidden

The document uses a feature that the configuration forbids: introspection, subscriptions, all mutations, or a specific named mutation.

How to Fix It

Client: send a single, well-formed GraphQL operation as POST with Content-Type: application/json, or a query as GET, within the limits of the API.
Operator: if legitimate queries are rejected, raise maxDepth, maxRecursion or maxMutations, add the method to allowedMethods, or set allowExtensions: true.
Operator: check the forbidden features if introspection or mutations are expected to work. Rejections are logged at info level with their message.

Hide Details in Production

By default, Membrane runs in development mode and adds details to error responses that help you find the problem. These details may reveal information about your setup. In production, turn them off:

configuration:
  production: true

configuration:
  production: true

Add the configuration document to your apis.yaml and separate it from the APIs with ---.