Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
apollo-opentracing
Advanced tools
Apollo Opentracing allows you to integrate open source baked performance tracing to your Apollo server based on industry standards for tracing.
Run npm install --save apollo-opentracing
given that you already setup an opentracing tracer accordingly.
We need two types of tracer (which could be identical if you like):
const { graphqlExpress } = require("apollo-server-express");
const {serverTracer, localTracer} = require("./tracer");
+const OpentracingPlugin = require("apollo-opentracing").default;
app.use(
"/graphql",
bodyParser.json(),
graphqlExpress({
schema,
+ plugins: [OpentracingPlugin({
+ server: serverTracer,
+ local: localTracer,
+ })]
})
)
To connect other services you need to use the opentracing inject function of your tracer.
We pass the current span down to your resolvers as info.span
, so you should use it.
You can also make use of it and add new logs or tags on the fly if you like. This may look something like this:
myFieldResolver(source, args, context, info) {
const headers = {...};
const parentSpan = info.span;
// please use the same tracer you passed down to the extension
const networkSpan = tracer.startSpan("NetworkRequest:" + endpoint, {
childOf: parentSpan
});
// Let's transfer the span information to the headers
tracer.inject(
networkSpan,
YourOpentracingImplementation.FORMAT_HTTP_HEADERS,
headers
);
return doNetworkRequest(endpoint, headers).then(result => {
networkSpan.finish()
return result;
}, err => {
networkSpan.log({
error: true,
errorMessage: err
});
networkSpan.finish();
return err;
});
}
Sometimes you don't want to trace everything, so we provide ways to select if you want to start a span right now or not.
If you construct the extension with shouldTraceRequest
you get the option to opt-in or out on a request basis.
When you don't start the span for the request the field resolvers will also not be used.
The function is called with the same arguments as the requestDidStart
function extensions can provide, which is documented here.
When the request is not traced there will also be no traces of the field resolvers.
There might be certain field resolvers that are not worth the tracing, e.g. when they get a value out of an object and need no further tracing. To control if you want a field resolver to be traced you can pass the shouldTraceFieldResolver
option to the constructor. The function is called with the same arguments as your field resolver and you can get the name of the field by info.fieldName
. When you return false no traces will be made of this field resolvers and all underlying ones.
If you'd like to add custom tags or logs to span you can construct the extension with onRequestResolve
. The function is called with two arguments: span and infos onRequestResolve?: (span: Span, info: RequestStart)
If you need to take control of initializing the request span (e.g because you need to use it during context initialization) you can do so by having creating it as context.requestSpan
.
server
: Opentracing Tracer for the incoming requestlocal
: Opentracing Tracer for the local and outgoing requestsonFieldResolve(source: any, args: { [argName: string]: any }, context: SpanContext, info: GraphQLResolveInfo)
: Allow users to add extra information to the spanonFieldResolveFinish(error: Error | null, result: any, span: Span)
: Callback after a field was resolvedshouldTraceRequest
& shouldTraceFieldResolver
: See Selective TracingonRequestResolve(span: Span, info: GraphQLRequestContext)
: Add extra information to the request spancreateCustomSpanName(name: String, info: GraphQLResolveInfo)
: Allow users to provide customized span nameonRequestError(rootSpan: Span, info: GraphQLRequestContextDidEncounterErrors)
: Callback when a request errorsPlease feel free to add issues with new ideas, bugs and anything that might come up. Let's make performance measurement to everyone <3
Thanks goes to these wonderful people (emoji key):
This project follows the all-contributors specification. Contributions of any kind welcome!
FAQs
Trace your GraphQL server with Opentracing
The npm package apollo-opentracing receives a total of 2,372 weekly downloads. As such, apollo-opentracing popularity was classified as popular.
We found that apollo-opentracing demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.