Hot Chocolate 16

Last reviewed Sep 6, 2026

Export as PDF

Prompt Details

Prompt Composition

3prompts
  1. C# 14106 lines · 4.4K tokens
  2. ASP.NET Core 10.065 lines · 3.5K tokens
  3. Hot Chocolate 1660 lines · 2.6K tokens
Total231 lines · 10.5K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 73
  • 78
  • 79
  • 89
  • 94
  • 117
  • 190
  • 208
  • 209
  • 214
  • 257
  • 295
  • 307
  • 312
  • 319
  • 323
  • 327
  • 328
  • 338
  • 352
  • 362
  • 367
  • 378
  • 426
  • 434
  • 488
  • 502
  • 524
  • 525
  • 532
  • 552
  • 601
  • 611
  • 613
  • 614
  • 636
  • 639
  • 674
  • 759
  • 770
  • 772
  • 775
  • 778
  • 798
  • 807
  • 862
  • 915
  • 916
  • 918
  • 942
  • 1004
  • 1275
  • 1333
  • 1385
  • 1395

Prompt Preview

Apply the ASP.NET Core 10.0 and C# 14 prompts first. These rules cover Hot Chocolate 16 schemas, resolvers, authorization, data loading, filtering, operation limits, persisted operations, errors, subscriptions, and deployment.

Schema and endpoint exposure

  • Keep AddGraphQL(..., disableDefaultSecurity: false) at its default; setting disableDefaultSecurity: true removes the built-in cost analysis, production introspection restriction, and maximum field-cycle-depth rule at once.
  • Configure MapGraphQL knowingly: it exposes HTTP GET, POST, multipart, WebSocket, Nitro, and ?sdl schema download by default, so disable or separately protect every transport and tool that clients do not require.
  • Keep GET limited to queries; do not set AllowedGetOperations to QueryAndMutation, because state-changing GET requests can be prefetched, cached, logged, or triggered cross-site.
  • Disable Nitro and schema download on public production routes; turning off introspection does not hide the schema while /graphql/schema.graphql remains mapped.
  • Use .AllowIntrospection(false) for public production schemas and treat any request-interceptor override that re-enables introspection as a privileged, authenticated operation.

Authentication and authorization

  • Protect the entire transport with MapGraphQL().RequireAuthorization() when the schema is private, then add Hot Chocolate field policies with GraphQL .AddAuthorization() and HotChocolate.Authorization.AuthorizeAttribute for finer-grained decisions.
  • Use Hot Chocolate’s