How do you secure a GraphQL API against abusive queries?

Question

IT Interview Practice · Accepted Answer

The flexibility that makes GraphQL powerful also makes it a **DoS surface**: a client can nest a query deeply or request huge lists in one call. You defend in layers — **depth limits, complexity/cost analysis, rate limiting, and proper auth** — none of which the query language enforces for you.

## The threat: unbounded queries

```graphql
# A malicious cyclic query: each level multiplies the work exponentially
query Bomb {
  user { friends { friends { friends { friends { name } } } } }
}
```

## Defenses

- **Depth limiting** — reject queries nested beyond, say, 7 levels. Cheap first line of defense.
- **Cost/complexity analysis** — assign each field a cost, weight list fields by their `first` argument, and reject before execution if the total exceeds a budget. Stronger than raw depth because it accounts for list breadth.
- **Rate limiting** — per-client budgets, ideally on **query cost** (not just request count), so one expensive query counts as many.
- **Persisted/allow-listed queries** — in production, accept only a pre-registered set of queries; arbitrary ad-hoc queries are refused, eliminating most injection/DoS vectors.

```js
import depthLimit from "graphql-depth-limit";
import costAnalysis from "graphql-cost-analysis";

const server = new ApolloServer({
  schema,
  validationRules: [
    depthLimit(7),                                  // block deep nesting
    costAnalysis({ maximumCost: 1000 }),            // block broad/expensive queries pre-execution
  ],
});
```

## Auth

Authenticate once (validate the token in `context`), then **authorize per field/resolver** — never trust the client to omit fields. Do checks in resolvers or a layer like GraphQL Shield, and **never expose the introspection schema** or verbose stack traces in production.

## Why it matters

REST endpoints are naturally bounded; a single GraphQL query is not. Senior interviewers want the **cost-based** mindset — depth is necessary but insufficient, complexity analysis plus persisted queries is the real answer — and the discipline of per-resolver authorization.

The threat: unbounded queries

Defenses

Auth

Why it matters

Related questions