Where the default settings were based from ?

[serraventura]

Hi there,

Congrats for the project it's a good addition to the GQL community.

I'm testing your library and using your default settings as in the link below.
https://github.com/Escape-Technologies/graphql-armor/blob/main/packages/plugins/cost-limit/src/index.ts#L20

Many of my queries are way beyond the library default settings.

As a matter of curiosity, I wonder where the default values were based from ?

Are those values a recommendation or just a random choice ?

This question doesn’t seem to fit as a Github issue, so, I'm using this discussion channel.

Thanks

[nullswan]

Hello @serraventura,

Thanks for your interest and your time dedicated to that observation.

Currently, these settings are chosen kind of randomly.

There is no official recommendation or specification concerning GraphQL limitation. (View current draft)
Our primary constraint while building GraphQL Armor is to work as-shipped, without configuration, on everyone's GraphQL server.
We backed our limitations on existing implementations and statistics gathered by our scanner engine.
By the way, @the-guild-org people made a tool that calculate your limitations (GraphQL Inspector) and I am recommending it in the coming documentation. (Cost limit will still remains an issue)

But, it appears that the Cost limit does not fit this constraint for your need.
It has already been reported as a "sensitive" plugin and challenging to handle for "everyone by default".
I am considering dropping it from the GraphQL Armor default remediation and let more space to the token limit.

I would be very interested if you could provide some additional details on what you noticed; which cost limit you observed, maybe?
Did you experience such issues as well with the token limit?

In the meantime, I would recommend you disable that plugin.

Armor({
  costLimit: {
   enabled: false
  }
})