GraphQL Security Architecture: Query depth limiting, complexity analysis, and disabling introspection.

Unique Security Challenges in GraphQL

Unlike REST APIs with fixed server-defined endpoints, GraphQL gives clients the power to request arbitrary nested schemas. Without safeguards, attackers can construct malicious queries that cause server denial of service.

# 1. Recursive Circular Query DOS Attack:
query EvilDeepQuery {
  author {
    books {
      author {
        books {
          author {
            books { # Infinite recursion! Server crashes with out-of-memory!
              title
            }
          }
        }
      }
    }
  }
}

Production GraphQL Hardening Suite

1. Query Depth Limiting: Reject queries whose AST nesting exceeds a strict threshold (e.g., max depth of 5 levels):

import depthLimit from 'graphql-depth-limit';

const server = new ApolloServer({
  schema,
  validationRules: [depthLimit(5)], // Rejects any query deeper than 5 levels!
});

2. Query Complexity Analysis: Assign cost points to each field (e.g., scalar fields = 1 point; list fields = 10 points). Reject queries exceeding 100 total points.
3. Disable Introspection in Production: Introspection allows attackers to map your entire database schema, internal types, and deprecated fields. Always disable introspection in production:

const server = new ApolloServer({
  introspection: process.env.NODE_ENV !== 'production',
});