Depth limiting in GraphQL - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ query_result

intermediate

What is the result of this GraphQL query with depth limit 2?

Given a GraphQL schema with nested types, and a depth limit of 2, what will be the result of this query?

{ user { id name posts { title comments { text } } } }

Assume the depth limit blocks fields nested deeper than 2.

A {"data":{"user":{"id":"1","name":"Alice","posts":[{"title":"Post 1","comments":[{"text":"Nice!"}]}]}}}

B {"data":{"user":{"id":"1","name":"Alice"}}}

C {"errors":[{"message":"Depth limit exceeded"}]}

D {"data":{"user":{"id":"1","name":"Alice","posts":[{"title":"Post 1"},{"title":"Post 2"}]}}}

💡 Hint

Depth limit 2 means fields nested more than 2 levels are blocked.

The query requests user (level 1), posts (level 2), and comments (level 3). Since depth limit is 2, comments are blocked, so only posts' titles are returned.

🧠 Conceptual

intermediate

Why is depth limiting important in GraphQL APIs?

Choose the best reason why depth limiting is used in GraphQL APIs.

A To prevent clients from requesting too much nested data causing performance issues

B To automatically cache all nested queries for faster responses

C To allow clients to request unlimited nested data without restrictions

D To encrypt nested fields for security

💡 Hint

Think about server load and query complexity.

Depth limiting prevents clients from making very deep nested queries that can overload the server or cause slow responses.

📝 Syntax

advanced

Which GraphQL query will cause a depth limit error with max depth 3?

Given a max depth of 3, which query will exceed the depth limit?

A { user { id posts { title comments { text } } } }

B { user { id posts { title comments { text author { name } } } } }

C { user { id posts { title } } }

D { user { id name } }

💡 Hint

Count the nesting levels carefully.

Option B has nesting: user (1), posts (2), comments (3), author (4) which exceeds max depth 3.

❓ optimization

advanced

How to optimize GraphQL server to handle deep queries safely?

Which approach best optimizes a GraphQL server to safely handle deep nested queries?

A Disable introspection to prevent deep queries

B Allow all queries and rely on client to limit nesting

C Implement depth limiting middleware to reject queries exceeding max depth

D Cache all query results regardless of depth

💡 Hint

Think about server-side protections.

Depth limiting middleware protects the server by rejecting overly deep queries before execution.

🔧 Debug

expert

Why does this GraphQL query pass depth limit but still cause performance issues?

Given a depth limit of 3, this query passes but the server is slow:

{ user { posts { comments { text } } } }

Why might this happen?

A The query returns too many items at each level causing large data volume

B The depth limit is set too low to block the query

C The query syntax is invalid causing retries

D The server has no indexes on user fields

💡 Hint

Depth limit controls nesting, not number of items returned.

Even with limited depth, if each nested list is large, the total data volume can be huge causing slow performance.

Practice

1.

What is the main purpose of depth limiting in GraphQL?

easy

A. To speed up the client-side rendering

B. To increase the depth of queries for more data

C. To limit the number of users accessing the server

D. To stop queries from going too deep and protect the server

Solution

1. Step 1: Understand what depth limiting controls

   Depth limiting restricts how deep a GraphQL query can go into nested fields.

2. Step 2: Identify the purpose of this restriction

   This prevents overly complex queries that can slow down or crash the server.

3. Final Answer:

   To stop queries from going too deep and protect the server -> Option D

4. Quick Check:

   Depth limiting = Protect server from deep queries [OK]

Hint: Depth limiting stops deep queries to keep server safe [OK]

Common Mistakes:

• Thinking depth limiting speeds up client rendering
• Confusing depth limiting with user access control
• Believing depth limiting increases query depth

2.

Which of the following is the correct way to set a maximum query depth of 5 in a GraphQL server using graphql-depth-limit?

const depthLimit = require('graphql-depth-limit');
const server = new ApolloServer({
  schema,
  validationRules: [ /* ??? */ ]
});

easy

A. validationRules: [depthLimit(5)]

B. validationRules: [depthLimit.max(5)]

C. validationRules: [depthLimit.setMaxDepth(5)]

D. validationRules: [depthLimit.limit(5)]

Solution

1. Step 1: Recall the usage of graphql-depth-limit

   The package exports a function called depthLimit that takes the max depth as an argument.

2. Step 2: Match the correct syntax

   The correct way is to pass depthLimit(5) inside validationRules array.

3. Final Answer:

   validationRules: [depthLimit(5)] -> Option A

4. Quick Check:

   depthLimit(5) sets max depth 5 [OK]

Hint: Use depthLimit(number) inside validationRules [OK]

Common Mistakes:

• Using non-existent methods like max or setMaxDepth
• Passing depthLimit without parentheses
• Placing depthLimit outside validationRules array

3.

Given this GraphQL query and a server with depth limit set to 3, what will happen?

{
  user {
    posts {
      comments {
        text
      }
    }
  }
}

medium

A. The query will succeed and return all comments' text

B. The query will return only user and posts without comments

C. The query will fail due to exceeding the depth limit

D. The query will return an empty response

Solution

1. Step 1: Calculate the query depth

   The query goes user (level 1) -> posts (level 2) -> comments (level 3) -> text (level 4). Depth is 4.

2. Step 2: Compare with the depth limit

   The server limits depth to 3, but query depth is 4, so it exceeds the limit.

3. Final Answer:

   The query will fail due to exceeding the depth limit -> Option C

4. Quick Check:

   Query depth 4 > limit 3 = fail [OK]

Hint: Count nested fields; if deeper than limit, query fails [OK]

Common Mistakes:

• Counting leaf fields as separate depth
• Assuming depth limit applies per field, not whole query
• Thinking partial data returns on depth limit exceed

4.

What is wrong with this GraphQL server setup code that tries to limit query depth?

const depthLimit = require('graphql-depth-limit');
const server = new ApolloServer({
  schema,
  validationRules: depthLimit(4)
});

medium

A. validationRules should be an array, not a single function

B. depthLimit should be called without arguments

C. schema must be inside validationRules

D. ApolloServer does not support validationRules

Solution

1. Step 1: Check the expected type of validationRules

   validationRules expects an array of functions, not a single function.

2. Step 2: Identify the mistake in the code

   The code passes depthLimit(4) directly, missing the array brackets.

3. Final Answer:

   validationRules should be an array, not a single function -> Option A

4. Quick Check:

   validationRules = [depthLimit(4)] [OK]

Hint: Wrap depthLimit call inside array for validationRules [OK]

Common Mistakes:

• Passing function directly instead of array
• Calling depthLimit without max depth argument
• Misplacing schema inside validationRules

5.

You want to allow queries up to depth 4 but block deeper ones. You also want to log a warning when a query exceeds the limit. Which approach correctly combines depth limiting with custom logging in a GraphQL server?

const depthLimit = require('graphql-depth-limit');
const { ApolloServer } = require('apollo-server');

const loggingDepthLimit = (maxDepth) => {
  return (context) => {
    const validationRule = depthLimit(maxDepth);
    return (validationContext) => {
      const errors = validationRule(validationContext);
      if (errors && errors.length > 0) {
        console.warn('Query depth exceeded:', errors);
      }
      return errors;
    };
  };
};

const server = new ApolloServer({
  schema,
  validationRules: [loggingDepthLimit(4)]
});

hard

A. depthLimit cannot be wrapped; this will cause runtime errors

B. This code correctly wraps depthLimit to log warnings on depth exceed

C. validationRules must be a single function, not an array

D. Logging should be done outside validationRules, this is incorrect

Solution

1. Step 1: Understand wrapping validation rules

   Validation rules are functions that can be wrapped to add behavior like logging.

2. Step 2: Analyze the custom logging wrapper

   The code creates a function that calls depthLimit and logs warnings if errors occur.

3. Step 3: Confirm usage in ApolloServer

   Passing the wrapped function inside an array to validationRules is correct.

4. Final Answer:

   This code correctly wraps depthLimit to log warnings on depth exceed -> Option B

5. Quick Check:

   Wrap validationRules to add logging = correct [OK]

Hint: Wrap depthLimit in function to add logging, pass in array [OK]

Common Mistakes:

• Assuming validationRules can't be wrapped
• Passing validationRules as single function instead of array
• Trying to log outside validationRules without access to errors