{"id":47911,"library":"graphql-no-batched-queries","title":"graphql-no-batched-queries","description":"GraphQL validation rule to prevent batched queries and mutations, mitigating denial-of-service and brute-force attacks. Current version is 2.0.2, released with TypeScript type definitions and supporting GraphQL v16+. The rule limits the number of root operation fields per request (default 1) and supports custom error messages. Unlike rate-limiting middleware, this is a validation-only approach that integrates directly into GraphQL execution pipelines (e.g., express-graphql, graphql-yoga, graphql-http). Also offers an optional Envelop plugin.","status":"active","version":"2.0.2","language":"javascript","source_language":"en","source_url":"https://github.com/ivandotv/graphql-no-batched-queries","tags":["javascript","graphql","graphql directive","graphql validation","graphql batching","graphql batched","graphql batch query","graphql batch mutation","typescript"],"install":[{"cmd":"npm install graphql-no-batched-queries","lang":"bash","label":"npm"},{"cmd":"yarn add graphql-no-batched-queries","lang":"bash","label":"yarn"},{"cmd":"pnpm add graphql-no-batched-queries","lang":"bash","label":"pnpm"}],"dependencies":[{"reason":"peer dependency; package exports a GraphQL validation rule conforming to the GraphQL.js spec","package":"graphql","optional":false}],"imports":[{"note":"Package uses CommonJS default export. TypeScript users can import as `import createValidation from ...` because of `esModuleInterop` or synthetic defaults.","wrong":"const createValidation = require('graphql-no-batched-queries').default","symbol":"default","correct":"import createValidation from 'graphql-no-batched-queries'"},{"note":"The package exports a single function as default, not as a named export.","wrong":"const { createValidation } = require('graphql-no-batched-queries')","symbol":"createValidation","correct":"const createValidation = require('graphql-no-batched-queries')"},{"note":"Available as a named export for those who prefer named imports; this is equivalent to the default export.","wrong":"","symbol":"NoBatchedQueriesRule","correct":"import { NoBatchedQueriesRule } from 'graphql-no-batched-queries'"}],"quickstart":{"code":"import { graphqlHTTP } from 'express-graphql';\nimport express from 'express';\nimport { buildSchema } from 'graphql';\nimport createValidation from 'graphql-no-batched-queries';\n\nconst schema = buildSchema(`\n  type Query {\n    hello: String\n  }\n`);\n\nconst root = {\n  hello: () => 'Hello world!',\n};\n\nconst validation = createValidation({ allow: 1 });\n\nconst app = express();\napp.use(\n  '/graphql',\n  graphqlHTTP({\n    schema,\n    rootValue: root,\n    graphiql: false,\n    validationRules: [validation],\n  })\n);\n\napp.listen(4000, () => console.log('GraphQL server running on http://localhost:4000/graphql'));","lang":"typescript","description":"Shows how to integrate graphql-no-batched-queries as a validation rule in an express-graphql server, allowing only 1 operation per request."},"warnings":[{"fix":"Upgrade to GraphQL v16.3.0 or later.","message":"Version 2.0.0 dropped support for GraphQL v15; only GraphQL v16.3.0+ is supported.","severity":"breaking","affected_versions":">=2.0.0"},{"fix":"Update import to 'graphql-no-batched-queries/envelop-plugin'.","message":"The envelop plugin (imported from 'graphql-no-batched-queries/envelop') is deprecated as of v2.0.0; use 'graphql-no-batched-queries/envelop-plugin' instead.","severity":"deprecated","affected_versions":">=2.0.0 <2.0.2"},{"fix":"Use in combination with graphql-no-alias directive to prevent duplicate field aliases.","message":"The validation rule still passes if a query uses aliases for different fields; it only counts root operation fields by name.","severity":"gotcha","affected_versions":"*"}],"env_vars":null,"search_vec":"'1':50 '2.0.2':28 'also':85 'approach':67 'attack':24 'batch':4,11,98,100,102,105 'brute':22 'brute-forc':21 'current':25 'custom':53 'default':49 'definit':33 'denial':17 'denial-of-servic':16 'direct':70,94 'e.g':75 'envelop':89 'error':54 'execut':73 'express':77 'express-graphql':76 'field':46 'forc':23 'graphql':2,6,36,72,78,80,83,92,93,95,97,99,101,104 'graphql-http':82 'graphql-no-batched-queri':1 'graphql-yoga':79 'http':84 'integr':69 'javascript':91 'limit':40,59 'messag':55 'middlewar':60 'mitig':15 'mutat':14,106 'number':42 'offer':86 'oper':45 'option':88 'per':47 'pipelin':74 'plugin':90 'prevent':10 'queri':5,12,103 'rate':58 'rate-limit':57 'releas':29 'request':48 'root':44 'rule':8,39 'servic':19 'support':35,52 'type':32 'typescript':31,107 'unlik':56 'v16':37 'valid':7,65,96 'validation-on':64 'version':26 'yoga':81","created_at":"2026-06-07T16:53:58.077724+00:00","updated_at":"2026-06-07T16:53:58.077724+00:00","problems":[{"fix":"Ensure you pass a valid GraphQLSchema object to the GraphQL server.","cause":"Attempting to create validation without a schema or with an invalid one.","error":"Must provide a valid GraphQL schema."},{"fix":"Upgrade to graphql v16.3.0 or later.","cause":"Using the validation rule without GraphQL v16 (document AST structure changed).","error":"Cannot read properties of undefined (reading 'definitions')"},{"fix":"Set `allow` to a positive integer (e.g., 1, 2, ...).","cause":"Passing a non-integer or negative value to the `allow` option.","error":"Invalid configuration: allow must be a positive integer."}],"ecosystem":"npm","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":null,"cli_name":null,"cli_version":null,"type":"library","homepage":"https://github.com/ivandotv/graphql-no-batched-queries#readme","github":"https://github.com/ivandotv/graphql-no-batched-queries","docs":null,"changelog":null,"pypi":null,"npm":"graphql-no-batched-queries","openapi_spec":null,"status_page":null,"smithery":null,"categories":["security"],"base_url":null,"auth_type":null,"provenance":{"verified_status":null,"verified_at":null,"last_verified":"2026-06-07","next_check":"2026-09-05","install_tag":null}}