Limit GraphQL Query Depth to Prevent Nested Abuse
Set a max depth of 7 so a malicious query like { user { posts { user { posts ... } } } } is rejected before execution.
Task
Implement const validation = depthLimit(7)(document); if (!validation.valid) throw new Error('too deep'); so the service degrades gracefully under failure instead of cascading timeouts to callers.
When to use this
A downstream service slows down and without const validation = depthLimit(7)(document); if (!validation.valid) throw new Error('too deep'); the upstream exhausts its thread pool in 12 seconds.
Prerequisites
- A service with inter-service calls or external dependencies
- A retry or circuit breaker library available
Steps
1. Configure const validation = depthLimit(7)(document); if (!validation.valid) throw new Error('too deep'); in the project configuration file with the recommended defaults.
const validation = depthLimit(7)(document); if (!validation.valid) throw new Error('too deep');
Expected output: The configuration is accepted and const validation = depthLimit(7)(document); if (!validation.valid) throw new Error('too deep'); runs without errors on the first invocation.
2. Run the check locally to verify const validation = depthLimit(7)(document); if (!validation.valid) throw new Error('too deep'); produces the expected result before pushing.
pnpm test
Expected output: Local run matches CI behavior; no surprises after push.
3. Add the gate to the CI pipeline so const validation = depthLimit(7)(document); if (!validation.valid) throw new Error('too deep'); blocks merge on failure.
- name: Run add graphql depth limit
run: pnpm test
Expected output: Pull requests with failing const validation = depthLimit(7)(document); if (!validation.valid) throw new Error('too deep'); are blocked from merging.
Troubleshooting
Problem
The check passes locally but fails in CI
Solution
Pin dependency versions and the runtime to match CI exactly; reproduce with the same Docker image or act.
Problem
Configuration is rejected with a schema error
Solution
Check the tool version matches the config schema; older versions may not support newer fields.
Limitations
- The gate only runs on events that trigger the workflow; locally pushed commits bypass it.
- Configuration drift is possible if someone edits settings outside version control.
Isolate failure
Start by measuring the problem. Set a max depth of 7 so a malicious query like { user { posts { user { posts … } } } } is rejected before execution. The most common mistake is adding the gate without first confirming it catches the issue you care about. Run const validation = depthLimit(7)(document); if (!validation.valid) throw new Error(‘too deep’); against the current codebase and inspect the output before wiring it into CI.
const validation = depthLimit(7)(document); if (!validation.valid) throw new Error('too deep');Verify graceful degradation
Once the gate is in place, make failures actionable. A failing const validation = depthLimit(7)(document); if (!validation.valid) throw new Error(‘too deep’); should point to the exact file and line, not a generic error. Pin the tool version in the lockfile so a upstream release does not silently change behavior. Review the gate output in every pull request just like a test result.