{"id":47897,"library":"graphql-limiter","title":"GraphQLGate / graphql-limiter","description":"GraphQLGate is a rate-limiting library for Node.js and Express that uses query complexity analysis to prevent abusive GraphQL queries. It assigns weights to fields, mutations, and queries to estimate response size, then throttles requests based on token bucket, fixed window, or sliding window algorithms backed by Redis. Version 1.3.0 is current; developed under OSLabs, inspired by IBM research. Key differentiators: depth limits, bounded list enforcement, and customizable type weights. Ships TypeScript definitions.","status":"active","version":"1.3.0","language":"javascript","source_language":"en","source_url":"https://github.com/oslabs-beta/graphql-gate","tags":["javascript","graphql","graphqlgate","rate-limiting","throttling","query","express","complexity","analysis","typescript"],"install":[{"cmd":"npm install graphql-limiter","lang":"bash","label":"npm"},{"cmd":"yarn add graphql-limiter","lang":"bash","label":"yarn"},{"cmd":"pnpm add graphql-limiter","lang":"bash","label":"pnpm"}],"dependencies":[{"reason":"peer dependency for schema introspection and type system","package":"graphql","optional":false},{"reason":"required for rate limiter state caching","package":"ioredis","optional":false},{"reason":"middleware integration for GraphQL endpoint","package":"express","optional":true}],"imports":[{"note":"Package is ESM-only. Use named import.","wrong":"const expressGraphQLRateLimiter = require('graphql-limiter')","symbol":"expressGraphQLRateLimiter","correct":"import { expressGraphQLRateLimiter } from 'graphql-limiter'"},{"note":"There is no default export. Must destructure named export.","wrong":"import graphQLRateLimiter from 'graphql-limiter'","symbol":"graphQLRateLimiter","correct":"import { graphQLRateLimiter } from 'graphql-limiter'"},{"note":"Utility to set custom timestamp for request windowing.","wrong":"","symbol":"setRequestTime","correct":"import { setRequestTime } from 'graphql-limiter'"},{"note":"Utility to hash operation for sliding window counter.","wrong":"","symbol":"setMD5Operation","correct":"import { setMD5Operation } from 'graphql-limiter'"}],"quickstart":{"code":"import { expressGraphQLRateLimiter } from 'graphql-limiter';\nimport express from 'express';\nimport { graphqlHTTP } from 'express-graphql';\nimport { buildSchema } from 'graphql';\n\nconst schema = buildSchema(`\n  type Query {\n    hello: String\n  }\n`);\n\nconst app = express();\n\napp.use('/graphql',\n  expressGraphQLRateLimiter(schema, {\n    rateLimiter: {\n      type: 'TOKEN_BUCKET',\n      refillRate: 10,\n      capacity: 100\n    },\n    depthLimit: 5,\n    enforceBoundedLists: true\n  }),\n  graphqlHTTP({ schema })\n);\n\napp.listen(4000, () => console.log('Server running on port 4000'));","lang":"typescript","description":"Demonstrates GraphQL rate limiting with token bucket algorithm, depth limit, and bounded list enforcement on an Express server."},"warnings":[{"fix":"Start Redis server (e.g., redis-server) or use mocked Redis in development.","message":"Redis must be running before middleware initializes, otherwise requests silently fail.","severity":"gotcha","affected_versions":">=1.0.0"},{"fix":"Set enforceBoundedLists: true or annotate all list fields with @listSize.","message":"List types without @listSize directive will cause infinite complexity if enforceBoundedLists is false.","severity":"gotcha","affected_versions":">=1.0.0"},{"fix":"Rename 'graphqlLimiter' to 'rateLimiter' in config.","message":"The 'graphqlLimiter' config option is deprecated; use 'rateLimiter' instead.","severity":"deprecated","affected_versions":">=0.9.0"},{"fix":"Use multiple instances for different complexity tiers, or override via middleware per route.","message":"Type weights apply globally; cannot differentiate per-type in a single schema.","severity":"gotcha","affected_versions":">=1.0.0"},{"fix":"Use token bucket or fixed window in clustered environments.","message":"Sliding window algorithms require a high-resolution clock; may not work correctly with clustered Node processes.","severity":"gotcha","affected_versions":">=1.0.0"}],"env_vars":null,"search_vec":"'1.3.0':55 'abus':23 'algorithm':50 'analysi':20,89 'assign':27 'back':51 'base':41 'bound':69 'bucket':44 'complex':19,88 'current':57 'customiz':73 'definit':78 'depth':67 'develop':58 'differenti':66 'enforc':71 'estim':35 'express':15,87 'field':30 'fix':45 'graphql':3,24,80 'graphql-limit':2 'graphqlgat':1,5,81 'ibm':63 'inspir':61 'javascript':79 'key':65 'librari':11 'limit':4,10,68,84 'list':70 'mutat':31 'node.js':13 'oslab':60 'prevent':22 'queri':18,25,33,86 'rate':9,83 'rate-limit':8,82 'redi':53 'request':40 'research':64 'respons':36 'ship':76 'size':37 'slide':48 'throttl':39,85 'token':43 'type':74 'typescript':77,90 'use':17 'version':54 'weight':28,75 'window':46,49","created_at":"2026-06-07T16:53:53.517938+00:00","updated_at":"2026-06-07T16:53:53.517938+00:00","problems":[{"fix":"Run 'npm install graphql-limiter --save' and ensure import is correct.","cause":"Missing package installation or incorrect import path.","error":"Error: Cannot find module 'graphql-limiter'"},{"fix":"Use 'import { expressGraphQLRateLimiter } from 'graphql-limiter' instead of default import.","cause":"Using default import instead of named import.","error":"TypeError: expressGraphQLRateLimiter is not a function"},{"fix":"Start Redis server or set custom Redis options via config.redis.options.","cause":"Redis server not running or misconfigured.","error":"Redis connection refused - ECONNREFUSED 127.0.0.1:6379"},{"fix":"Increase rateLimiter.capacity or refillRate, or simplify the query.","cause":"Query depth or computed complexity over limit.","error":"Query complexity exceeded maximum allowed complexity"}],"ecosystem":"npm","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":null,"cli_name":null,"cli_version":null,"type":"library","homepage":"https://github.com/oslabs-beta/GraphQL-Gate#readme","github":"https://github.com/oslabs-beta/graphql-gate","docs":null,"changelog":null,"pypi":null,"npm":"graphql-limiter","openapi_spec":null,"status_page":null,"smithery":null,"categories":["security"],"base_url":null,"auth_type":null,"provenance":{"verified_status":null,"verified_at":null,"last_verified":"2026-06-07","next_check":"2026-09-05","install_tag":null}}