Depth limiting in GraphQL - Mini Project: Build & Apply

GraphQL Depth Limiting

📖 Scenario: You are building a GraphQL API for a simple blog system. To keep the API safe and fast, you want to limit how deep clients can query nested data.

🎯 Goal: Create a GraphQL schema with types for Author and Post. Then add a depth limit configuration to restrict queries to a maximum depth of 2.

📋 What You'll Learn

Define a GraphQL type Author with fields id (ID), name (String), and posts (list of Post)

Define a GraphQL type Post with fields id (ID), title (String), and content (String)

Create a root Query type with a field authors returning a list of Author

Add a depth limiting configuration that restricts query depth to 2

💡 Why This Matters

🌍 Real World

APIs often need limits on query complexity to avoid slow or expensive requests. Depth limiting helps keep GraphQL APIs safe and fast.

💼 Career

Backend developers and API engineers use depth limiting to protect GraphQL services from abuse and performance issues.

1

Define GraphQL Types

Create GraphQL types Author and Post with the exact fields: Author has id (ID), name (String), and posts (list of Post). Post has id (ID), title (String), and content (String).

GraphQL

# Define GraphQL types Author and Post with specified fields

Hint

Use type keyword to define types. Lists are wrapped in square brackets like [Post].

2

Add Root Query Type

Add a root Query type with a field authors that returns a list of Author.

GraphQL

type Author {
  id: ID
  name: String
  posts: [Post]
}

type Post {
  id: ID
  title: String
  content: String
}

# Add Query type with authors field returning [Author]

Hint

The root query type is named Query. Define authors as a list of Author.

3

Set Depth Limit Variable

Create a variable called maxDepth and set it to 2 to limit query depth.

GraphQL

type Author {
  id: ID
  name: String
  posts: [Post]
}

type Post {
  id: ID
  title: String
  content: String
}

type Query {
  authors: [Author]
}

# Set maxDepth variable to 2

Hint

Use const maxDepth = 2 to create the depth limit variable.

4

Apply Depth Limiting Middleware

Add a depth limiting middleware configuration using maxDepth to restrict queries to depth 2. Use depthLimit(maxDepth) in your GraphQL server setup.

GraphQL

type Author {
  id: ID
  name: String
  posts: [Post]
}

type Post {
  id: ID
  title: String
  content: String
}

type Query {
  authors: [Author]
}

const maxDepth = 2;

# Add depthLimit(maxDepth) middleware in server setup

Hint

Use validationRules: [depthLimit(maxDepth)] in your ApolloServer config to apply depth limiting.

Practice

1.

What is the main purpose of depth limiting in GraphQL?

easy

A. To speed up the client-side rendering

B. To increase the depth of queries for more data

C. To limit the number of users accessing the server

D. To stop queries from going too deep and protect the server

Solution

1. Step 1: Understand what depth limiting controls

   Depth limiting restricts how deep a GraphQL query can go into nested fields.

2. Step 2: Identify the purpose of this restriction

   This prevents overly complex queries that can slow down or crash the server.

3. Final Answer:

   To stop queries from going too deep and protect the server -> Option D

4. Quick Check:

   Depth limiting = Protect server from deep queries [OK]

Hint: Depth limiting stops deep queries to keep server safe [OK]

Common Mistakes:

• Thinking depth limiting speeds up client rendering
• Confusing depth limiting with user access control
• Believing depth limiting increases query depth

2.

Which of the following is the correct way to set a maximum query depth of 5 in a GraphQL server using graphql-depth-limit?

const depthLimit = require('graphql-depth-limit');
const server = new ApolloServer({
  schema,
  validationRules: [ /* ??? */ ]
});

easy

A. validationRules: [depthLimit(5)]

B. validationRules: [depthLimit.max(5)]

C. validationRules: [depthLimit.setMaxDepth(5)]

D. validationRules: [depthLimit.limit(5)]

Solution

1. Step 1: Recall the usage of graphql-depth-limit

   The package exports a function called depthLimit that takes the max depth as an argument.

2. Step 2: Match the correct syntax

   The correct way is to pass depthLimit(5) inside validationRules array.

3. Final Answer:

   validationRules: [depthLimit(5)] -> Option A

4. Quick Check:

   depthLimit(5) sets max depth 5 [OK]

Hint: Use depthLimit(number) inside validationRules [OK]

Common Mistakes:

• Using non-existent methods like max or setMaxDepth
• Passing depthLimit without parentheses
• Placing depthLimit outside validationRules array

3.

Given this GraphQL query and a server with depth limit set to 3, what will happen?

{
  user {
    posts {
      comments {
        text
      }
    }
  }
}

medium

A. The query will succeed and return all comments' text

B. The query will return only user and posts without comments

C. The query will fail due to exceeding the depth limit

D. The query will return an empty response

Solution

1. Step 1: Calculate the query depth

   The query goes user (level 1) -> posts (level 2) -> comments (level 3) -> text (level 4). Depth is 4.

2. Step 2: Compare with the depth limit

   The server limits depth to 3, but query depth is 4, so it exceeds the limit.

3. Final Answer:

   The query will fail due to exceeding the depth limit -> Option C

4. Quick Check:

   Query depth 4 > limit 3 = fail [OK]

Hint: Count nested fields; if deeper than limit, query fails [OK]

Common Mistakes:

• Counting leaf fields as separate depth
• Assuming depth limit applies per field, not whole query
• Thinking partial data returns on depth limit exceed

4.

What is wrong with this GraphQL server setup code that tries to limit query depth?

const depthLimit = require('graphql-depth-limit');
const server = new ApolloServer({
  schema,
  validationRules: depthLimit(4)
});

medium

A. validationRules should be an array, not a single function

B. depthLimit should be called without arguments

C. schema must be inside validationRules

D. ApolloServer does not support validationRules

Solution

1. Step 1: Check the expected type of validationRules

   validationRules expects an array of functions, not a single function.

2. Step 2: Identify the mistake in the code

   The code passes depthLimit(4) directly, missing the array brackets.

3. Final Answer:

   validationRules should be an array, not a single function -> Option A

4. Quick Check:

   validationRules = [depthLimit(4)] [OK]

Hint: Wrap depthLimit call inside array for validationRules [OK]

Common Mistakes:

• Passing function directly instead of array
• Calling depthLimit without max depth argument
• Misplacing schema inside validationRules

5.

You want to allow queries up to depth 4 but block deeper ones. You also want to log a warning when a query exceeds the limit. Which approach correctly combines depth limiting with custom logging in a GraphQL server?

const depthLimit = require('graphql-depth-limit');
const { ApolloServer } = require('apollo-server');

const loggingDepthLimit = (maxDepth) => {
  return (context) => {
    const validationRule = depthLimit(maxDepth);
    return (validationContext) => {
      const errors = validationRule(validationContext);
      if (errors && errors.length > 0) {
        console.warn('Query depth exceeded:', errors);
      }
      return errors;
    };
  };
};

const server = new ApolloServer({
  schema,
  validationRules: [loggingDepthLimit(4)]
});

hard

A. depthLimit cannot be wrapped; this will cause runtime errors

B. This code correctly wraps depthLimit to log warnings on depth exceed

C. validationRules must be a single function, not an array

D. Logging should be done outside validationRules, this is incorrect

Solution

1. Step 1: Understand wrapping validation rules

   Validation rules are functions that can be wrapped to add behavior like logging.

2. Step 2: Analyze the custom logging wrapper

   The code creates a function that calls depthLimit and logs warnings if errors occur.

3. Step 3: Confirm usage in ApolloServer

   Passing the wrapped function inside an array to validationRules is correct.

4. Final Answer:

   This code correctly wraps depthLimit to log warnings on depth exceed -> Option B

5. Quick Check:

   Wrap validationRules to add logging = correct [OK]

Hint: Wrap depthLimit in function to add logging, pass in array [OK]

Common Mistakes:

• Assuming validationRules can't be wrapped
• Passing validationRules as single function instead of array
• Trying to log outside validationRules without access to errors