Query cost and abuse

Key points

• A deeply nested query can explode: friends of friends of friends multiplies quickly.
• Depth limiting rejects queries nested beyond a fixed level.
• Cost analysis scores fields and rejects anything over a budget - fairer than raw depth.
• Persisted queries: clients send a hash of an approved query, so arbitrary queries are impossible.
• Disable introspection in production if you do not want your whole schema published.

Example

# a small query that is very expensive
query Bomb {
  customer(id: "1") {
    orders {                    # 50
      customer {                # 50
        orders {                # 2,500
          customer { orders { product } }   # 125,000
        }
      }
    }
  }
}

Client-shaped queries need a server-side budget - depth limiting is the minimum, persisted queries the strongest.