Policies

GraphQL Complexity Limit Policy

This policy allows you to add a limit for the depth and a limit for the complexity of a GraphQL query.

Configuration

The configuration shows how to configure the policy in the 'policies.json' document.

{ "name": "my-graphql-complexity-limit-inbound-policy", "policyType": "graphql-complexity-limit-inbound", "handler": { "export": "GraphQLComplexityLimitInboundPolicy", "module": "$import(@zuplo/runtime)", "options": { "useComplexityLimit": { "complexityLimit": 10 }, "useDepthLimit": { "ignore": [] } } } }

Policy Options

The options for this policy are specified below. All properties are optional unless specifically marked as required.

  • useComplexityLimit <object> (Required) -
    • complexityLimit <number> -
      The maximum complexity a query is allowed to have.
    • endpointUrl <string> -
      The endpoint URL to use for the complexity calculation.
  • useDepthLimit <object> (Required) -
    • depthLimit <number> -
      The maximum depth a query is allowed to have.
    • ignore <string[]> -
      The fields to ignore when calculating the depth of a query.

Using the Policy

Depth Limit#

Limit the depth a GraphQL query is allowed to query for.

  • maxDepth - Number of levels a GraphQL query is allowed to query for.

This allows you to limit the depth of a GraphQL query. This is useful to prevent DoS attacks on your GraphQL server.

{ # Level 0 me { # Level 1 name friends { # Level 2 name friends { # Level 3 name # ... } } } }

Complexity Limit#

Example:

  • maxComplexity - Maximum complexity allowed for a query.
{ me { name # Complexity +1 age # Complexity +1 email # Complexity +1 friends { name # Complexity +1 height # Complexity +1 } } } # Total complexity = 5

Read more about how policies work

Previous
GraphQL Disable Introspection