
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
GraphQL.Client.Abstractions.Websocket
Advanced tools
Abstractions for the Websocket transport used in GraphQL.Client
A GraphQL Client for .NET Standard over HTTP.
Provides the following packages:
The Library will try to follow the following standards and documents:
The intended use of GraphQLHttpClient
is to keep one instance alive per endpoint (obvious in case you're
operating full websocket, but also true for regular requests) and is built with thread-safety in mind.
// To use NewtonsoftJsonSerializer, add a reference to
// NuGet package GraphQL.Client.Serializer.Newtonsoft
var graphQLClient = new GraphQLHttpClient(
"https://api.example.com/graphql",
new NewtonsoftJsonSerializer());
[!NOTE] GraphQLHttpClient is meant to be used as a single long-lived instance per endpoint (i.e. register as singleton in a DI system), which should be reused for multiple requests.
var heroRequest = new GraphQLRequest {
Query = """
{
hero {
name
}
}
"""
};
var personAndFilmsRequest = new GraphQLRequest {
Query ="""
query PersonAndFilms($id: ID) {
person(id: $id) {
name
filmConnection {
films {
title
}
}
}
}
""",
OperationName = "PersonAndFilms",
Variables = new {
id = "cGVvcGxlOjE="
}
};
[!WARNING] Be careful when using
byte[]
in your variables object, as most JSON serializers will treat that as binary data.If you really need to send a list of bytes with a
byte[]
as a source, then convert it to aList<byte>
first, which will tell the serializer to output a list of numbers instead of a base64-encoded string.
public class ResponseType
{
public PersonType Person { get; set; }
}
public class PersonType
{
public string Name { get; set; }
public FilmConnectionType FilmConnection { get; set; }
}
public class FilmConnectionType {
public List<FilmContentType> Films { get; set; }
}
public class FilmContentType {
public string Title { get; set; }
}
var graphQLResponse = await graphQLClient.SendQueryAsync<ResponseType>(personAndFilmsRequest);
var personName = graphQLResponse.Data.Person.Name;
Using the extension method for anonymously typed responses (namespace GraphQL.Client.Abstractions
) you could achieve the same result with the following code:
var graphQLResponse = await graphQLClient.SendQueryAsync(
personAndFilmsRequest,
() => new { person = new PersonType()});
var personName = graphQLResponse.Data.person.Name;
[!IMPORTANT] Note that the field in the GraphQL response which gets deserialized into the response object is the
data
field.A common mistake is to try to directly use the
PersonType
class as response type (because thats the thing you actually want to query), but the returned response object contains a propertyperson
containing aPersonType
object (like theResponseType
modelled above).
public class UserJoinedSubscriptionResult {
public ChatUser UserJoined { get; set; }
public class ChatUser {
public string DisplayName { get; set; }
public string Id { get; set; }
}
}
var userJoinedRequest = new GraphQLRequest {
Query = @"
subscription {
userJoined{
displayName
id
}
}"
};
IObservable<GraphQLResponse<UserJoinedSubscriptionResult>> subscriptionStream
= client.CreateSubscriptionStream<UserJoinedSubscriptionResult>(userJoinedRequest);
var subscription = subscriptionStream.Subscribe(response =>
{
Console.WriteLine($"user '{response.Data.UserJoined.DisplayName}' joined")
});
subscription.Dispose();
Automatic persisted queries (APQ) are supported since client version 6.1.0.
APQ can be enabled by configuring GraphQLHttpClientOptions.EnableAutomaticPersistedQueries
to resolve to true
.
By default, the client will automatically disable APQ for the current session if the server responds with a PersistedQueryNotSupported
error or a 400 or 600 HTTP status code.
This can be customized by configuring GraphQLHttpClientOptions.DisableAPQ
.
To re-enable APQ after it has been automatically disabled, GraphQLHttpClient
needs to be disposed an recreated.
APQ works by first sending a hash of the query string to the server, and only sending the full query string if the server has not yet cached a query with a matching hash.
With queries supplied as a string parameter to GraphQLRequest
, the hash gets computed each time the request is sent.
When you want to reuse a query string (propably to leverage APQ :wink:), declare the query using the GraphQLQuery
class. This way, the hash gets computed once on construction
of the GraphQLQuery
object and handed down to each GraphQLRequest
using the query.
GraphQLQuery query = new("""
query PersonAndFilms($id: ID) {
person(id: $id) {
name
filmConnection {
films {
title
}
}
}
}
""");
var graphQLResponse = await graphQLClient.SendQueryAsync<ResponseType>(
query,
"PersonAndFilms",
new { id = "cGVvcGxlOjE=" });
.NET 7.0 introduced the StringSyntaxAttribute to have a unified way of telling what data is expected in a given string
or ReadOnlySpan<char>
. IDEs like Visual Studio and Rider can then use this to provide syntax highlighting and checking.
From v6.0.4 on all GraphQL string parameters in this library are decorated with the [StringSyntax("GraphQL")]
attribute.
Currently, there is no native support for GraphQL formatting and syntax highlighting in Visual Studio, but the GraphQLTools Extension provides that for you.
For Rider, JetBrains provides a Plugin, too.
To leverage syntax highlighting in variable declarations, use the GraphQLQuery
class.
Blazor WebAssembly differs from other platforms as it does not support all features of other .NET runtime implementations. For instance, the following WebSocket options properties are not supported and will not be set:
FAQs
Abstractions for the Websocket transport used in GraphQL.Client
We found that graphql.client.abstractions.websocket demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.