fix(ui): bypass GraphQL for createTask, call Queue API directly (fixes #8171) by nitishagar · Pull Request #8260 · taskcluster/taskcluster

nitishagar · 2026-02-07T14:54:24Z

Summary

The UI's createTask calls (loaner, retrigger, submitTaskAction, CreateTask page) now call the Queue REST API directly via @taskcluster/client-web instead of routing through GraphQL
This fixes 413 errors when creating tasks with payloads larger than 100KB (the default bodyParser.json limit) — up to the Queue API's 10MB limit
Also fixes a latent bug where authorizedScopes passed via GraphQL options were silently dropped by the resolver; the Queue client now receives them correctly via getClient({ authorizedScopes: ... })
Reverts the server-side body-size limit increases from the previous approach (no changes to createApp.js vs main)
Deletes the now-unused createTask.graphql mutation file

Approach

Per architect review by @lotas in #8171: skipping the GraphQL layer for task creation avoids widening the Apollo attack surface (increased body limits have historically been a source of security issues in Apollo).

The UI already uses @taskcluster/client-web for other endpoints (e.g. WorkerManager.removeWorker). Task creation follows the same getClient() pattern.

Test plan

cd ui && yarn test — all 52 suites / 137 tests pass (including new submitTaskAction.test.js)
cd ui && yarn lint — no errors
cd services/web-server && yarn test — validation_test.js passes with original 413 + PayloadTooLargeError assertions
Manually verify task creation with a large payload (>100KB) succeeds in the UI

GitHub Bug/Issue: Fixes #8171

services/web-server/test/graphql/validation_test.js

nitishagar · 2026-02-17T07:01:23Z

@lotas Updated based on the feedback. Please take a look when you get a chance.

lotas · 2026-02-17T08:46:44Z

services/web-server/src/servers/createApp.js

    cors(corsOptions),
    credentials(),
    bodyParserGraphql.graphql({
      limit: '1mb',


I think this might no longer be applied because we limit bodyParser at 10mb now

lotas · 2026-02-17T08:47:53Z

services/web-server/test/graphql/validation_test.js

-      const client = helper.getHttpClient({ suppressErrors: true });
+      // Send a payload exceeding the 10mb body-parser limit.
+      // Uses got directly to avoid gql parsing overhead for large payloads.
+      const response = await got.post(


Do you know what was the issue with gql? and why we want to avoid this? If you keep original code and just change the value what is happening then?

The got switch was to avoid gql parsing a >10MB string client-side, but that's only needed if we're testing the body parser limit directly. Since we're keeping the original 100k-repeat test (~300KB — well within gql's comfort zone), I've reverted back to using gql + helper client. No issues.

lotas · 2026-02-17T08:48:29Z

@lotas Updated based on the feedback. Please take a look when you get a chance.

thanks, I have left two comments, I think we need to align limits and I'm not sure why you used got instead of client?

lotas · 2026-02-17T08:55:20Z

services/web-server/test/graphql/validation_test.js

-        await client.query({
-          query: gql`
-            query {
-              ${' a '.repeat(100000)}


Oh, I just realized that test was testing something completely different -

taskcluster/services/web-server/src/main.js

Line 158 in c6c55c5

maxTokens: 100000,

max tokens is limited to 100000 here, so this test shouldn't be changed

lotas · 2026-02-17T08:55:37Z

services/web-server/test/graphql/validation_test.js

+        {
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({
+            query: `query { ${'a'.repeat(11 * 1024 * 1024)} }`,


Please note that original test contained spaces around ' a ' for a reason - that test was testing 'maxTokens'

nagarwal-godaddy · 2026-02-24T06:02:58Z

Thank you for the review @lotas! I've addressed the feedback.

lotas · 2026-02-25T11:51:12Z

Sorry for the delay, I would check this soon, need to make sure that we don't open up some other kind of problems with such increase of max size in graphql, since it was a source of frequent denial-of-service kind of attacks

lotas · 2026-03-04T14:04:56Z

@nitishagar we have discussed this a bit and came to conclusion that we'd rather use API directly than change graphql body size limits: #8171 (comment)

If you feel comfortable working on this, let me know, otherwise I'll close this PR.
Thank you again for the help so far

Task creation in the UI now calls the Queue REST API directly using @taskcluster/client-web instead of routing through the GraphQL web-server. This fixes 413 errors when creating tasks with payloads larger than 100KB (the default bodyParser.json limit), without requiring any server-side limit increases. Also fixes a latent bug where authorizedScopes passed via GraphQL options were silently dropped by the resolver; the Queue client now receives them correctly. Closes taskcluster#8171

lotas · 2026-03-13T14:14:00Z

ui/src/views/Tasks/submitTaskAction.js

+  form,
+  action,
+  apolloClient,
+  user,


Please check

taskcluster/ui/src/views/Tasks/TaskGroup/index.jsx

Lines 629 to 635 in 25c072b

const taskId = await submitTaskAction({

task,

taskActions,

form,

action,

apolloClient,

});

TaskGroup is still calling this without a user context

nitishagar requested a review from a team as a code owner February 7, 2026 14:54

nitishagar requested review from lotas, matt-boris and petemoore and removed request for a team February 7, 2026 14:54

nitishagar force-pushed the fix/8171-graphql-payload-limit branch from 73443a3 to 6a3c10f Compare February 8, 2026 07:06

lotas reviewed Feb 9, 2026

View reviewed changes

services/web-server/test/graphql/validation_test.js Outdated Show resolved Hide resolved

nitishagar force-pushed the fix/8171-graphql-payload-limit branch 2 times, most recently from 699ee32 to 6246159 Compare February 17, 2026 06:26

lotas reviewed Feb 17, 2026

View reviewed changes

nitishagar force-pushed the fix/8171-graphql-payload-limit branch from 6246159 to c81f421 Compare February 24, 2026 05:58

nitishagar changed the title ~~fix(web-server): increase GraphQL body size limit to 10mb (fixes #8171)~~ fix(ui): bypass GraphQL for createTask, call Queue API directly (fixes #8171) Mar 13, 2026

nitishagar force-pushed the fix/8171-graphql-payload-limit branch from c81f421 to a2ae12e Compare March 13, 2026 07:02

nitishagar force-pushed the fix/8171-graphql-payload-limit branch from a2ae12e to 25c072b Compare March 13, 2026 08:20

lotas reviewed Mar 13, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(ui): bypass GraphQL for createTask, call Queue API directly (fixes #8171)#8260

fix(ui): bypass GraphQL for createTask, call Queue API directly (fixes #8171)#8260
nitishagar wants to merge 1 commit intotaskcluster:mainfrom
nitishagar:fix/8171-graphql-payload-limit

nitishagar commented Feb 7, 2026 •

edited

Loading

Uh oh!

Uh oh!

nitishagar commented Feb 17, 2026

Uh oh!

lotas Feb 17, 2026

Uh oh!

lotas Feb 17, 2026

Uh oh!

nagarwal-godaddy Feb 24, 2026

Uh oh!

lotas commented Feb 17, 2026

Uh oh!

lotas Feb 17, 2026

Uh oh!

lotas Feb 17, 2026 •

edited

Loading

Uh oh!

nagarwal-godaddy commented Feb 24, 2026

Uh oh!

lotas commented Feb 25, 2026

Uh oh!

lotas commented Mar 4, 2026

Uh oh!

lotas Mar 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	const taskId = await submitTaskAction({
	task,
	taskActions,
	form,
	action,
	apolloClient,
	});

Conversation

nitishagar commented Feb 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Approach

Test plan

Uh oh!

Uh oh!

nitishagar commented Feb 17, 2026

Uh oh!

lotas Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

lotas Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

nagarwal-godaddy Feb 24, 2026

Choose a reason for hiding this comment

Uh oh!

lotas commented Feb 17, 2026

Uh oh!

lotas Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

lotas Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

nagarwal-godaddy commented Feb 24, 2026

Uh oh!

lotas commented Feb 25, 2026

Uh oh!

lotas commented Mar 4, 2026

Uh oh!

lotas Mar 13, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

nitishagar commented Feb 7, 2026 •

edited

Loading

lotas Feb 17, 2026 •

edited

Loading