Policies
GraphQL Complexity Limit Policy
This policy allows you to add a limit for the depth and a limit for the complexity of a GraphQL query.
Configuration
The configuration shows how to configure the policy in the 'policies.json' document.
{ "name": "my-graphql-complexity-limit-inbound-policy", "policyType": "graphql-complexity-limit-inbound", "handler": { "export": "GraphQLComplexityLimitInboundPolicy", "module": "$import(@zuplo/runtime)", "options": { "useComplexityLimit": { "complexityLimit": 10 }, "useDepthLimit": { "ignore": [] } } } }
Policy Options
The options for this policy are specified below. All properties are optional unless specifically marked as required.
useComplexityLimit
<object> (Required) -complexityLimit
<number> -The maximum complexity a query is allowed to have.endpointUrl
<string> -The endpoint URL to use for the complexity calculation.
useDepthLimit
<object> (Required) -depthLimit
<number> -The maximum depth a query is allowed to have.ignore
<string[]> -The fields to ignore when calculating the depth of a query.
Using the Policy
Depth Limit#
Limit the depth a GraphQL query is allowed to query for.
- maxDepth - Number of levels a GraphQL query is allowed to query for.
This allows you to limit the depth of a GraphQL query. This is useful to prevent DoS attacks on your GraphQL server.
{ # Level 0 me { # Level 1 name friends { # Level 2 name friends { # Level 3 name # ... } } } }
Complexity Limit#
Example:
- maxComplexity - Maximum complexity allowed for a query.
{ me { name # Complexity +1 age # Complexity +1 email # Complexity +1 friends { name # Complexity +1 height # Complexity +1 } } } # Total complexity = 5
Read more about how policies work