A customizable security middleware for Apollo GraphQL, Yoga, and Envelop GraphQL servers.
GraphQL Armor is a security middleware that adds a protective layer to GraphQL servers, guarding against common threats like denial-of-service attacks, query abuse, and introspection exploits. It integrates with Apollo GraphQL, Yoga, and Envelop-compatible servers to enhance API security with minimal setup.
GraphQL API developers and DevOps engineers who need to secure their GraphQL endpoints against malicious queries and vulnerabilities.
Developers choose GraphQL Armor for its simplicity, extensive compatibility with major GraphQL engines, and customizable security rules that provide robust protection without requiring deep security expertise.
🛡️ The missing GraphQL security security layer for Apollo GraphQL and Yoga / Envelop servers 🛡️
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Integrates directly with popular GraphQL engines like Apollo Server and GraphQL Yoga with minimal setup, as shown in the straightforward installation steps.
Provides comprehensive features such as query depth limiting, alias limiting, and cost analysis to guard against common attacks like denial-of-service.
Allows fine-tuning of security policies, enabling developers to adjust limits and settings to match specific application needs, as highlighted in the key features.
Supports a wide range of GraphQL engines through the Envelop plugin system, including serverless platforms like Cloudflare Workers and AWS Lambda.
For engines not natively supported, integration requires the Envelop plugin system, adding an extra layer of dependency and potential setup overhead.
As a security middleware, it introduces additional processing for each query, which could impact latency in high-throughput scenarios, though not explicitly quantified in the README.
The tool is specifically designed for GraphQL APIs and cannot be applied to secure other types of API protocols like REST or gRPC.