Query depth and complexity in GraphQL - Mini Project: Build & Apply

Understanding GraphQL Query Depth and Complexity

📖 Scenario: You are building a simple GraphQL API for a bookstore. Customers can query books and authors. To keep the API fast and safe, you want to control how deep and complex queries can be.

🎯 Goal: Learn how to set up and enforce query depth and complexity limits in a GraphQL API to prevent overly complex queries that slow down the server.

📋 What You'll Learn

Create a basic GraphQL schema with types Book and Author

Add a query type with fields books and authors

Set a maximum query depth limit of 3

Set a maximum query complexity limit of 10

Validate queries against these limits

💡 Why This Matters

🌍 Real World

Limiting query depth and complexity is important in real GraphQL APIs to prevent slowdowns and crashes caused by very large or deeply nested queries.

💼 Career

Many companies use GraphQL and need developers who understand how to keep APIs performant and secure by controlling query complexity.

1

Create the GraphQL schema with Book and Author types

Write the GraphQL schema defining a Book type with fields id (ID), title (String), and author (Author). Also define an Author type with fields id (ID) and name (String). Finally, create a Query type with fields books and authors that return lists of Book and Author respectively.

GraphQL

# Write the GraphQL schema with Book, Author, and Query types

Hint

Define the types and their fields exactly as described. Use exclamation marks ! to mark required fields.

2

Add a configuration for maximum query depth

In your GraphQL server setup code, create a variable called maxQueryDepth and set it to 3. This will limit how deep queries can go.

GraphQL

type Book {
  id: ID!
  title: String!
  author: Author!
}

type Author {
  id: ID!
  name: String!
}

type Query {
  books: [Book!]!
  authors: [Author!]!
}

# Create a variable maxQueryDepth and set it to 3

Hint

Use a constant named maxQueryDepth and assign it the number 3.

3

Add a configuration for maximum query complexity

Add a variable called maxQueryComplexity and set it to 10 in your server setup code. This will limit how complex queries can be.

GraphQL

type Book {
  id: ID!
  title: String!
  author: Author!
}

type Author {
  id: ID!
  name: String!
}

type Query {
  books: [Book!]!
  authors: [Author!]!
}

const maxQueryDepth = 3;
# Create a variable maxQueryComplexity and set it to 10

Hint

Use a constant named maxQueryComplexity and assign it the number 10.

4

Apply query depth and complexity validation in the GraphQL server

In your GraphQL server setup, add middleware or validation rules that use maxQueryDepth and maxQueryComplexity to reject queries exceeding these limits. Use the variables maxQueryDepth and maxQueryComplexity exactly in your validation code.

GraphQL

type Book {
  id: ID!
  title: String!
  author: Author!
}

type Author {
  id: ID!
  name: String!
}

type Query {
  books: [Book!]!
  authors: [Author!]!
}

const maxQueryDepth = 3;
const maxQueryComplexity = 10;

# Add validation rules using maxQueryDepth and maxQueryComplexity

Hint

Use the functions depthLimit and createComplexityLimitRule with the variables maxQueryDepth and maxQueryComplexity to create validation rules.