skill-security-graphql

Protect GraphQL APIs from query-based attacks by enforcing depth limits, complexity analysis, introspection controls, and rate limiting to prevent server overload and schema discovery abuse.

Prevent deeply nested GraphQL queries from overloading your server by applying depth limiting using a library like graphql-depth-limit to cap query nesting levels.

Cap expensive GraphQL query costs by implementing complexity analysis with graphql-query-complexity to estimate and limit the computational cost of incoming operations.

Disable or restrict GraphQL introspection in production to prevent malicious actors from discovering your schema structure and mapping potential attack vectors against your API.

Apply per-operation rate limiting and batch request prevention to GraphQL APIs to stop clients from sending large batches of operations that could overwhelm server resources.

Use persisted queries to solidify pre-registered GraphQL workloads, ensuring only approved queries execute and reducing the attack surface for dynamic query injection.