
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
next-graphql
Advanced tools
NextGraphQL.js is a zero-config GraphQL server for Next.js, supporting Vercel Serverless environment runtime.
From your main Next.js project path run:
npx next-graphql init
Then, open http://localhost:3000/api/graphql.
It's really easy to build a schema using Nexus and NextGraphQL:
// pages/api/graphql.ts
import { extendType, objectType, makeSchema } from "nexus"
import { handler as nextGraphQLHandler } from "next-graphql"
export const config = {
api: {
bodyParser: false,
},
}
const Query = extendType({
type: "Query",
definition(t) {
t.field("hello", {
type: "String",
resolve() {
return "Hello, world"
},
})
},
})
const nexus = makeSchema({
types: [Query],
})
export default nextGraphQLHandler({
schemas: {
nexus,
},
})
For a complete example, see examples/nexus.
One of the main motivations behind this project was to provide a more integrated experience with GraphQL and Authentication.
Most BaaS services provide some sort of authentication capabilities but having deep auth integration with your project is beneficial.
Adding NextAuth is a few lines of code.
// pages/api/graphql.ts
import { getSession } from "next-auth/client"
import { handler as nextGraphQLHandler } from "next-graphql"
export const config = {
api: {
bodyParser: false,
},
}
export default nextGraphQLHandler({
session: ({ req }) => getSession({ req })
schemas: {
// ...
}
})
This will add a {session}
object to the resolver context.
You can easily guard content:
// pages/api/graphql.ts
import { getSession } from "next-auth/client"
import { handler as nextGraphQLHandler } from "next-graphql"
import { isAuthenticated } from "next-graphql/auth"
export const config = {
api: {
bodyParser: false,
},
}
export default nextGraphQLHandler({
session: ({ req }) => getSession({ req })
schemas: {
// ...
},
guards: {
Query: {
myQuery: isAuthenticated
}
}
})
Remote schemas are a first-class citizen in NextGraphQL. By default all schemas are merged and stitched together creating a primary, "gateway" schema.
For a full working remote example, see see examples/remote
This will add the SpaceX GraphQL endpoints:
// pages/api/graphql.ts
import { handler as nextGraphQLHandler, remote } from "next-graphql"
export const config = {
api: {
bodyParser: false,
},
}
export default nextGraphQLHandler({
schemas: {
spacex: remote("https://api.spacex.land/graphql"),
},
})
Now suppose that you want to guard some of the endpoints in the remote schema:
// pages/api/graphql.ts
import { handler as nextGraphQLHandler, remote } from "next-graphql"
import { rule } from "next-graphql/guards"
const fiftyPercentFailWithError = rule()(async (parent, args, ctx, info) => {
return Math.floor(Math.random() * 100) % 2 === 0 ? true : new Error("You were randomly selected to have this endpoint fail.")
})
export const config = {
api: {
bodyParser: false,
},
}
export default nextGraphQLHandler({
schemas: {
spacex: remote("https://api.spacex.land/graphql"),
},
guards: {
Query: {
ships: fiftyPercentFailWithError
}
}
})
Suppose you want to add an authorized endpoint, i.e. GraphCMS:
// pages/api/graphql.ts
import { handler as nextGraphQLHandler, remote } from "next-graphql"
export const config = {
api: {
bodyParser: false,
},
}
export default nextGraphQLHandler({
schemas: {
graphcms: remote(process.env.GRAPHCMS_URL, {
headers: {
Authorization: "Bearer " + process.env.GRAPHCMS_TOKEN,
},
}),
},
})
Sometimes we want to alter the upstream schema. This removes all references to Ship, which will also prune the final schema removing all unused types from the gateway schema.
// pages/api/graphql.ts
import { handler as nextGraphQLHandler, remote } from "next-graphql"
export const config = {
api: {
bodyParser: false,
},
}
export default nextGraphQLHandler({
schemas: {
spacex: remote("https://api.spacex.land/graphql", {
prune: {
types: (type) => !type.match(/Ship/),
},
}),
},
})
NextGraphQL supports an Extension format to make it easy for submodule development:
// pages/api/graphql.ts
import { handler as nextGraphQLHandler, remote } from "next-graphql"
export const config = {
api: {
bodyParser: false,
},
}
const customExtender = {
resolvers: {
Query: {
ships: async (obj, args, context) => {
return getDataFromOtherSource() // custom override resolver
}
}
}
}
export default nextGraphQLHandler({
schemas: {
spacex: remote("https://api.spacex.land/graphql"),
},
extensions: [customExtender]
})
Extensions support the following options:
export type Extension = {
typeDefs?: string
resolvers?: {
[key: string]: any
}
middleware?: Middleware | Middleware[]
guards?: Guards
}
NextGraphQL is a new project but we're super grateful to all our contributors as we expand and built out the project.
We'd also like to make a massive shoutout to the Guild team for their contributions to GraphQL, without which this project wouldn't exist.
MIT
FAQs
GraphQL for Next.js
The npm package next-graphql receives a total of 0 weekly downloads. As such, next-graphql popularity was classified as not popular.
We found that next-graphql demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.