Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@blabu.com/apollo-opentracing
Advanced tools
Apollo Opentracing allows you to integrate open source baked performance tracing to your Apollo server based on industry standards for tracing.
Run npm install --save apollo-opentracing
given that you already setup an opentracing tracer accordingly.
We need two types of tracer (which could be identical if you like):
const { graphqlExpress } = require("apollo-server-express");
const {serverTracer, localTracer} = require("./tracer");
+const OpentracingExtension = require("apollo-opentracing").default;
app.use(
"/graphql",
bodyParser.json(),
graphqlExpress({
schema,
+ extensions: [() => new OpentracingExtension({
+ server: serverTracer,
+ local: localTracer,
+ })]
})
)
To connect other services you need to use the opentracing inject function of your tracer.
We pass the current span down to your resolvers as info.span
, so you should use it.
You can also make use of it and add new logs or tags on the fly if you like. This may look something like this:
myFieldResolver(source, args, context, info) {
const headers = {...};
const parentSpan = info.span;
// please use the same tracer you passed down to the extension
const networkSpan = tracer.startSpan("NetworkRequest:" + endpoint, {
childOf: parentSpan
});
// Let's transfer the span information to the headers
tracer.inject(
networkSpan,
YourOpentracingImplementation.FORMAT_HTTP_HEADERS,
headers
);
return doNetworkRequest(endpoint, headers).then(result => {
networkSpan.finish()
return result;
}, err => {
networkSpan.log({
error: true,
errorMessage: err
});
networkSpan.finish();
return err;
});
}
Sometimes you don't want to trace everything, so we provide ways to select if you want to start a span right now or not.
If you construct the extension with shouldTraceRequest
you get the option to opt-in or out on a request basis.
When you don't start the span for the request the field resolvers will also not be used.
The function is called with the same arguments as the requestDidStart
function extensions can provide, which is documented here.
When the request is not traced there will also be no traces of the field resolvers.
There might be certain field resolvers that are not worth the tracing, e.g. when they get a value out of an object and need no further tracing. To control if you want a field resolver to be traced you can pass the shouldTraceFieldResolver
option to the constructor. The function is called with the same arguments as your field resolver and you can get the name of the field by info.fieldName
. When you return false no traces will be made of this field resolvers and all underlying ones.
Please feel free to add issues with new ideas, bugs and anything that might come up. Let's make performance measurement to everyone <3
Thanks goes to these wonderful people (emoji key):
Daniel Schmidt 💻 🤔 | Ciaran Liedeman 🐛 💻 ⚠️ | Jens Ulrich Hjuler Pedersen 🐛 🤔 👀 | Francesca 💻 |
---|
This project follows the all-contributors specification. Contributions of any kind welcome!
FAQs
Trace your GraphQL server with Opentracing
The npm package @blabu.com/apollo-opentracing receives a total of 0 weekly downloads. As such, @blabu.com/apollo-opentracing popularity was classified as not popular.
We found that @blabu.com/apollo-opentracing demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.