graphql-review

Detect N+1 queries in GraphQL resolvers by analyzing resolver-level database access patterns, then implement DataLoader batching to optimize data fetching and eliminate redundant queries.

Secure a GraphQL API against abuse by validating query depth and complexity limits, enforcing rate limiting, restricting introspection policies, and implementing persisted queries for production environments.

Yes, you can apply this review to Apollo federated subgraphs. It validates federation directives, checks subgraph composition, and ensures field-level authorization across federated schemas.

The best way to enforce field-level authorization in a GraphQL schema is to review resolver implementations to verify authorization checks, validate input types, and ensure proper security boundaries are applied per field.

Validate GraphQL schema design by checking naming consistency, nullability practices, connection-style pagination, and descriptions to avoid god types and prevent breaking changes across the API.

You need persisted queries and caching strategies for GraphQL performance when hardening production APIs, enabling automatic persisted queries, connection pooling, and deferred responses to optimize query execution.