Your public GraphQL endpoint lets one client send a query ten levels deep, and it takes the database down. How do you stop that without breaking legitimate clients?
Estimate GraphQL query cost before execution, multiplying list fields by their enforced page size, and reject anything over budget. Add a depth limit as a backstop, persisted queries for your own apps, execution timeouts, and per-client rate limits counted in cost points, not requests.
Answer
Short answer
Score every operation before you run it. Compute a GraphQL query cost from the parsed document and reject any operation over a budget. In that estimate, a list field multiplies the cost of everything beneath it by its enforced page size. A depth limit is a cheap backstop, not the main control. Around it go page-size caps, persisted queries for your own apps, an execution timeout that reaches the database, and per-client rate limits charged in cost points rather than requests.
Was this answer helpful?
Likely follow-ups
- A list field has no page-size argument and returns whatever the database holds. How does your cost estimate handle it?
- How do you price a field whose resolver calls a slow third-party API, compared with one that reads a cached column?
- Your estimate says a query is cheap, but it ran for forty seconds. What do you change, the estimate or the enforcement?
- One partner needs a nightly export that blows through any sensible per-query budget. What do you give them instead?
Related questions
- Rate-limit an LLM gateway where one request can cost a hundred times another.hardAlso on rate-limiting5 min
- Your rate limiter has to work across twenty gateway instances. What does Redis do, and what breaks first?hardAlso on rate-limiting5 min
- You must ingest all of English Wikipedia every day, and the source does not want to be hammered. What runs, how often, and what do you do about the run that fails at hour six?hardAlso on rate-limiting6 min
- One tenant bursts to ten times their normal traffic and every other customer's latency doubles. Your global rate limit was never hit. How would you design for fairness instead?hardAlso on rate-limiting5 min