graphql

Use DataLoader to batch and cache database queries across resolvers within a single request. Without it, each resolver fires its own query, so a list of 100 users triggers 100 separate database calls.

Enforce query depth limiting and query cost analysis on the server. Deeply nested queries can act as a denial-of-service vector, so reject queries exceeding a configured depth or complexity budget.

Authorize in resolvers, not only in schema directives. Schema-level rules alone miss field-level access control, so enforce authorization per field inside resolver logic where data is actually fetched.

Yes, disable introspection in production to avoid exposing your full schema to attackers. Keep it enabled in development for tooling, and rely on persisted queries or schema registries for client needs.

Apollo Client provides a normalized cache with type policies for fine-grained cache control, while urql offers a lighter-weight alternative with a plugin-based exchange architecture. Choose based on how much cache customization your app requires.

In GraphQL, a failed non-null field propagates null upward to the nearest nullable parent, potentially wiping out large parts of the response. Design nullability intentionally so errors do not cascade into unrelated data.