{"record":{"id":"18f77cb68b5908f7","repo":"dgraph-io/dgraph","slug":"chkpwd-function-is-not-supported-in-the-rdf-output","errorCode":null,"errorMessage":"chkpwd function is not supported in the rdf output format","messagePattern":"chkpwd function is not supported in the rdf output format","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"query/outputrdf.go","lineNumber":229,"sourceCode":"\treturn buf\n}\n\nfunc validateSubGraphForRDF(sg *SubGraph) error {\n\tif sg.IsGroupBy() {\n\t\treturn errors.New(\"groupby is not supported in rdf output format\")\n\t}\n\tuidCount := sg.Attr == \"uid\" && sg.Params.DoCount && sg.IsInternal()\n\tif uidCount {\n\t\treturn errors.New(\"uid count is not supported in the rdf output format\")\n\t}\n\tif sg.Params.Normalize {\n\t\treturn errors.New(\"normalize directive is not supported in the rdf output format\")\n\t}\n\tif sg.Params.IgnoreReflex {\n\t\treturn errors.New(\"ignorereflex directive is not supported in the rdf output format\")\n\t}\n\tif sg.SrcFunc != nil && sg.SrcFunc.Name == \"checkpwd\" {\n\t\treturn errors.New(\"chkpwd function is not supported in the rdf output format\")\n\t}\n\tif sg.Params.Facet != nil && !sg.Params.ExpandAll {\n\t\treturn errors.New(\"facets are not supported in the rdf output format\")\n\t}\n\treturn nil\n}\n\nfunc quotedNumber(val []byte) []byte {\n\tconst overhead = 2 // opening and closing quotes\n\tif len(val) > math.MaxInt-overhead {\n\t\t// Extremely unlikely, but handle overflow case\n\t\ttmpVal := make([]byte, 0)\n\t\ttmpVal = append(tmpVal, '\"')\n\t\ttmpVal = append(tmpVal, val...)\n\t\ttmpVal = append(tmpVal, '\"')\n\t\treturn tmpVal\n\t}\n\ttmpVal := make([]byte, 0, overhead+len(val))","sourceCodeStart":211,"sourceCodeEnd":247,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/query/outputrdf.go#L211-L247","documentation":"The checkpwd function compares a password hash and only makes sense for authentication queries returning JSON. validateSubGraphForRDF rejects any sub-graph whose source function is checkpwd when outputting RDF.","triggerScenarios":"A query like `{ q(func: eq(password, checkpwd(pw, \"hash\"))) { uid } }` run with RDF output format.","commonSituations":"Login/auth queries accidentally routed through an RDF-configured endpoint or export tool.","solutions":["Use JSON output for authentication queries","Perform password checking in application code (fetch the hash, verify locally)","Separate auth queries from RDF export queries"],"exampleFix":"// before (rdf output)\n{ q(func: eq(password, checkpwd($pw, $hash))) { uid } }\n// after\n// run with JSON output, or fetch hash and verify in app code (e.g. bcrypt.CompareHashAndPassword)","handlingStrategy":"validation","validationCode":"// Go: never route checkpwd queries to RDF output\nif strings.Contains(query, \"checkpwd(\") {\n    return errors.New(\"checkpwd requires JSON output; do not use for RDF export\")\n}","typeGuard":"func usesCheckPwd(dql string) bool {\n    return strings.Contains(dql, \"checkpwd(\")\n}","tryCatchPattern":"res, err := txn.QueryRDF(ctx, dql)\nif err != nil && strings.Contains(err.Error(), \"chkpwd function is not supported\") {\n    return txn.Query(ctx, dql)\n}","preventionTips":["Keep authentication queries on JSON endpoints only","Never run auth queries through generic export pipelines","Verify passwords in application code where possible"],"tags":["dgraph","rdf","checkpwd","query-validation"],"backgroundTag":"feature-not-supported-in-rdf-output","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}