GraphQL Complexity Limit Policy
This policy allows you to add a limit for the depth and a limit for the complexity of a GraphQL query.
Configuration
The configuration shows how to configure the policy in the 'policies.json' document.
Policy Configuration
name
<string> - The name of your policy instance. This is used as a reference in your routes.policyType
<string> - The identifier of the policy. This is used by the Zuplo UI. Value should begraphql-complexity-limit-inbound
.handler.export
<string> - The name of the exported type. Value should beGraphQLComplexityLimitInboundPolicy
.handler.module
<string> - The module containing the policy. Value should be$import(@zuplo/runtime)
.handler.options
<object> - The options for this policy. See Policy Options below.
Policy Options
The options for this policy are specified below. All properties are optional unless specifically marked as required.
useComplexityLimit
<object> (Required) -complexityLimit
<number> -The maximum complexity a query is allowed to have.endpointUrl
<string> -The endpoint URL to use for the complexity calculation.
useDepthLimit
<object> (Required) -depthLimit
<number> -The maximum depth a query is allowed to have.ignore
<string[]> -The fields to ignore when calculating the depth of a query.
Using the Policy
Depth Limit#
Limit the depth a GraphQL query is allowed to query for.
- maxDepth - Number of levels a GraphQL query is allowed to query for.
This allows you to limit the depth of a GraphQL query. This is useful to prevent DoS attacks on your GraphQL server.
{ # Level 0 me { # Level 1 name friends { # Level 2 name friends { # Level 3 name # ... } } } }
Complexity Limit#
Example:
- maxComplexity - Maximum complexity allowed for a query.
{ me { name # Complexity +1 age # Complexity +1 email # Complexity +1 friends { name # Complexity +1 height # Complexity +1 } } } # Total complexity = 5
Read more about how policies work