← GraphQL learning pathGraphQL · Module 9 of 10
Security and performance
Protect GraphQL APIs from expensive and malicious queries.
📖 Key ideas
- Limit query depth and complexity.
- Use persisted queries to allow only known operations.
- Authorise at the field or resolver level.
- Disable introspection in production if not needed.
- Paginate lists and set timeouts.
💡 Real-life example: Query limits are a buffet rule: you can choose freely, but not take 50 plates at once.
Depth limitMax nesting level allowed
Query complexityCost score for a query
Persisted queryPre-registered query by id
IntrospectionQuerying the schema itself