GraphQL Rate Limiting and Depth Limiting Setup

GraphQL gives clients great flexibility, but that same flexibility makes the API vulnerable. A single query with 50 levels of nesting and hundreds of aliases can generate millions of objects, hammering the CPU and database. We've encountered cases where an unrestricted endpoint collapsed under just a couple of requests per minute. According to the official GraphQL documentation, protection against such aspects is mandatory for production releases. Comprehensive protection demands depth limiting (nesting restriction), query complexity (operation cost), and rate limiting (request throttling) – three key mechanisms we implement. Depth limiting is 3× more effective than naive time-based restrictions. Within 1-2 business days, we configure these limits for your API.

What Problems We Solve

Without limits, a GraphQL API is prone to DoS attacks. An attacker can send a single query with recursive nesting (user → friends → friends...) that forces the database to execute thousands of JOINs. Or via aliases, they request the same field 500 times, simulating a DDoS. Another vector is expensive operations like search or export that consume many resources. We solve these problems comprehensively using depth limiting, query complexity, and rate limiting. The combination of these three methods is 10× more effective against DoS attacks than any single layer. The cost of such attacks can reach lost revenue due to downtime — for example, a 30-minute outage may cost $10,000 for an e-commerce site, so protection pays off quickly. For a medium-sized deployment, this setup reduces hosting costs by approximately $5,000 per year.

How to Configure Depth Limiting?

Depth limiting restricts the maximum nesting level of the query's AST tree. We set a threshold of 7 levels — enough for typical schemas but blocking recursive queries. For most schemas, a threshold of 7 is optimal: it covers 99% of legitimate queries.

import depthLimit from 'graphql-depth-limit' import { ApolloServer } from '@apollo/server' const server = new ApolloServer({ typeDefs, resolvers, validationRules: [ depthLimit(7) ] }) 

An attack without depth limit looks like:

{ user { friends { friends { friends { friends { friends { id name } } } } } } } 

Why Is Query Complexity Check Important?

Depth does not account for query breadth: a query with depth 2 but requesting 10,000 records via pagination is also dangerous. Query complexity calculates the total cost using multipliers for pagination arguments. Compare three approaches in the table:

Query complexity is 5× more effective for breadth attacks than depth limiting alone.

import { createComplexityLimitRule } from 'graphql-query-complexity' import { fieldExtensionsEstimator, simpleEstimator } from 'graphql-query-complexity' const complexityRule = createComplexityLimitRule(1000, { estimators: [ fieldExtensionsEstimator(), ({ type, field, args, childComplexity }) => { if (args.limit) return args.limit * childComplexity if (args.first) return args.first * childComplexity return 1 + childComplexity }, simpleEstimator({ defaultComplexity: 1 }) ], onSuccess: (complexity) => console.log(`Query complexity: ${complexity}`), formatErrorMessage: (complexity) => `Query too complex (${complexity}). Max allowed: 1000` }) 

Comparison of GraphQL protection libraries:

Rate Limiting with Redis

Rate limiting in GraphQL considers both request count and complexity. We use Redis for counters: a limit on operations (200 ops/min) and on total complexity (10,000). For expensive operations (SearchUsers, ExportData), we set separate limits — up to 5 calls per minute.

class GraphQLRateLimiter { constructor(redis) { this.r = redis } async checkRequest(userId, operationName, complexity) { const now = Math.floor(Date.now() / 1000) const minute = now - (now % 60) const opsKey = `gql:ops:${userId}:${minute}` const ops = await this.r.incr(opsKey) this.r.expire(opsKey, 120) if (ops > 200) { throw new GraphQLError('Too many requests', { extensions: { code: 'RATE_LIMITED', retryAfter: 60 } }) } const complexityKey = `gql:complexity:${userId}:${minute}` const totalComplexity = await this.r.incrby(complexityKey, complexity) this.r.expire(complexityKey, 120) if (totalComplexity > 10000) { throw new GraphQLError('Query complexity budget exceeded', { extensions: { code: 'COMPLEXITY_LIMITED', retryAfter: 60 } }) } const expensiveOps = ['SearchUsers', 'ExportData', 'GenerateReport'] if (expensiveOps.includes(operationName)) { const expKey = `gql:expensive:${userId}:${minute}` const expCount = await this.r.incr(expKey) this.r.expire(expKey, 120) if (expCount > 5) { throw new GraphQLError(`Too many ${operationName} calls`, { extensions: { code: 'RATE_LIMITED' } }) } } return { allowed: true, remainingOps: 200 - ops } } } 

import { createArmor } from '@escape.tech/graphql-armor' const armor = createArmor({ maxAliases: { n: 15 }, maxDirectives: { n: 50 }, maxDepth: { n: 7 }, maxTokens: { n: 1000 }, costLimit: { maxCost: 5000, objectCost: 2, scalarCost: 1, depthCostFactor: 1.5, ignoreIntrospection: true } }) const server = new ApolloServer({ typeDefs, resolvers, plugins: [...armor.plugins], validationRules: [...armor.validationRules] })