Query Limiting Depth

[AstRonin]

Is your feature request related to a problem? Please describe.
Graphene has query validation about Depth limit Validator (https://docs.graphene-python.org/en/latest/execution/queryvalidation/#depth-limit-validator).

validation_errors = validate(
    schema=schema.graphql_schema,
    document_ast=parse('THE QUERY'),
    rules=(
        depth_limit_validator(
            max_depth=20
        ),
    )
)

Would be great we will have it (depth) in django project.

Describe the solution you'd like
Limit depth of query. OWASP suggest add limit for security reason https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html#query-limiting-depth-amount

[AstRonin]

Can this
#1342 (comment)
example usable also for my question?

[kiendang]

@AstRonin I believe that would work.

@firaskafri @sjdemartini @ulgens This use case has been requested a couple of time. If we go the route of porting over graphql-core graphql_impl to improve performance (see #1439 (comment) and #1393 (comment)), this would be quite easy to add validation_rules as another option to GraphQLView. I could submit a PR for this, but currently I'm not using it so defer to you on it's worth implementing or not.

[sjdemartini]

@kiendang I like the idea of adding validation rules as an option to GraphQLView. I didn't realize that was already a feature of graphene (and just not graphene-django). Sounds like it's worthwhile given requests like this and the ability to support both graphene's built-in validation like depth-limits, as well as potentially other user-defined validators.

[sjdemartini]

@kiendang now that you've merged in the performance improvements and refactoring around graphene-django's query execution (thank you!), are you still planning on adding an option for validation rules in the GraphQLView? No rush, just curious. I've recently been thinking more about validation in a GraphQL app I work on, and this seems like it'd be a nice addition to graphene-django to enable some of that.

[kiendang]

Yup I just put up a PR in #1475. Implementation is simple but I haven't added any test though.