graphql-security

Secure a GraphQL server against unbounded query depth attacks by enforcing fixed maximum query depth limits and applying cost-bound analysis to resolver execution. This prevents deeply nested queries from exhausting server resources.

Disable GraphQL introspection in production by configuring production-introspection gating on your server. This prevents unintended schema exposure while allowing introspection to remain active in development environments.

The best way to prevent GraphQL batch and alias attacks is applying per-operation rate limits for sensitive mutations alongside query cost analysis. This bounds resource consumption and blocks attackers from exhausting server capacity.

Yes, this GraphQL security guidance works with Apollo Server and gqlgen, as well as graphql-yoga and Strawberry. It provides specific configuration recommendations for securing these common GraphQL server setups in production.

You need cost analysis alongside depth limiting because depth alone cannot prevent wide, shallow queries that still exhaust resolver resources. Cost analysis assigns weights to fields, bounding total execution cost per operation.

Apply per-operation rate limits to GraphQL mutations when they access sensitive operations such as authentication or payment processing. This prevents abuse by bounding how frequently individual clients can invoke those specific resolvers.