1

Is there a good way to modify the input from a mutation using a Request Middleware in HotChocolate? We want to sanitize the data that is entered through free text input fields in order to migitate XSS attacks.

After some research I found out that if a custom Request Middleware is injected into the default HotChocolate pipeline after the DocumentParser middleware, we can read the data passed in through context.Request.VariableValues but not modify it as it is set up as an IReadOnlyDictionary. As far as I understand HotChocolate, this could be solved with Field Middleware, but we would like to "automate" this in the pipeline in case someone forgets to add the custom Field Attribute to a property that needs to be sanitized.

KrisMale
  • 11
  • 1

1 Answers1

1

What you can do is take a type interceptor to automatically add the field middleware to all mutation fields. Or if you want to to all fields that have arguments.

Michael Ingmar Staib
  • 1,721
  • 9
  • 22