• Or alternatively:
  • Depth-limiting.
  • Breadth-limiting.
  • Alias limits.
  • Cycle rejection.
  • Cost analysis.

• Send operations via GET.
• Multipart upload requests must include Apollo-Require-Preflight.

• Which origins can access its resources.
• Which types of HTTP requests are allowed.

• A security mechanism.
• Restricts scripts on one origin from interacting with resources from another origin.

Protect your GraphQL servers against resource exhaustion and DoS attacks.

• Reject queries to your GraphQL server that are deemed too costly to execute.
• Learn more here.

To do this we need to perform analysis the cost of executing a query.

There are tools that can help us to do this:

• graphql-query-complexity.

It is directly related to your GraphQL schema design:

• If you can send the following query to your GraphQL service:

  query {
    getPosts {
      id
      author {
        posts {
          id
          author {
            posts {
              id
              author {
                posts {
                  id
                  author {
                    id
                  }
                }
              }
            }
          }
        }
      }
    }
  }

• And let's assume like in our example you're using a tool like join-monster which will convert your query into this SQL:

  SELECT
      "getPosts"."id" AS "id",
      "author"."id" AS "author__id",
      "posts"."id" AS "author__posts__id",
      "author$"."id" AS "author__posts__author$__id",
      "posts$"."id" AS "author__posts__author$__posts$__id",
      "author$$"."id" AS "author__posts__author$__posts$__author$$__id",
      "posts$$"."id" AS "author__posts__author$__posts$__author$$__posts$$__id",
      "author$$$"."id" AS "author__posts__author$__posts$__author$$__posts$$__author$$$__id"
  FROM post "getPosts"
  LEFT JOIN public.user "author" ON "author".id = "getPosts"."authorId"
  LEFT JOIN post "posts" ON "author".id = "posts"."authorId"
  LEFT JOIN public.user "author$" ON "author$".id = "posts"."authorId"
  LEFT JOIN post "posts$" ON "author$".id = "posts$"."authorId"
  LEFT JOIN public.user "author$$" ON "author$$".id = "posts$"."authorId"
  LEFT JOIN post "posts$$" ON "author$$".id = "posts$$"."authorId"
  LEFT JOIN public.user "author$$$" ON "author$$$".id = "posts$$"."authorId"