GraphQL security best practices - Mini Project: Build & Apply

GraphQL Security Best Practices

📖 Scenario: You are building a GraphQL API for a small online bookstore. You want to make sure your API is secure and protects sensitive data while allowing users to query book information safely.

🎯 Goal: Build a simple GraphQL schema with security best practices such as limiting query depth, validating inputs, and restricting access to sensitive fields.

📋 What You'll Learn

Create a GraphQL schema with types for Book and Query

Add a query called books that returns a list of Book

Add a configuration variable MAX_QUERY_DEPTH set to 3

Implement a query depth validation rule using MAX_QUERY_DEPTH

Add a field secretNote to Book that is only accessible to authenticated users

Add input validation for a search argument in the books query

💡 Why This Matters

🌍 Real World

GraphQL APIs are widely used in web and mobile apps. Securing them protects user data and prevents attacks like denial of service.

💼 Career

Understanding GraphQL security best practices is important for backend developers, API engineers, and security specialists working with modern APIs.

1

Create the GraphQL schema with Book and Query types

Create a GraphQL schema with a Book type that has fields id (ID!), title (String!), and author (String!). Also create a Query type with a books field that returns a list of Book.

GraphQL

type Book {
  id: ID!
  title: String!
  author: String!
}

type Query {
  books: [Book]
}

# Your code here

Need a hint?

Define the Book type with the required fields and the Query type with a books field returning a list of Book.

2

Add a configuration variable for max query depth

Add a configuration variable called MAX_QUERY_DEPTH and set it to 3 to limit the depth of GraphQL queries.

GraphQL

type Book {
  id: ID!
  title: String!
  author: String!
}

type Query {
  books: [Book]
}

const MAX_QUERY_DEPTH = 3
# Your code here

Need a hint?

Define a constant MAX_QUERY_DEPTH and assign it the value 3.

3

Implement query depth validation using MAX_QUERY_DEPTH

Add a query depth validation rule that uses the MAX_QUERY_DEPTH variable to reject queries deeper than 3 levels.

GraphQL

type Book {
  id: ID!
  title: String!
  author: String!
}

type Query {
  books: [Book]
}

const MAX_QUERY_DEPTH = 3

// Add query depth validation rule here
# Your code here

Need a hint?

Use a library like graphql-depth-limit and create a validation rule array using MAX_QUERY_DEPTH.

4

Add secretNote field with access control and input validation

Add a secretNote field to the Book type that returns a String. This field should only be accessible if the user is authenticated. Also, add a search argument of type String to the books query and validate that it is not longer than 20 characters.

GraphQL

type Book {
  id: ID!
  title: String!
  author: String!
  secretNote: String
}

type Query {
  books(search: String): [Book]
}

const MAX_QUERY_DEPTH = 3

const depthLimitRule = require('graphql-depth-limit');

const validationRules = [depthLimitRule(MAX_QUERY_DEPTH)];

// Add resolver logic to check authentication and validate search input
# Your code here

Need a hint?

Add the secretNote field to the Book type and the search argument to the books query. Implement resolver logic to check if the user is authenticated before returning secretNote and validate the length of search.