GraphQL vs RESTful APIs in High-Traffic Systems: N+1 Solvers and Query Depth Limiting

The Vulnerability of Unbounded GraphQL Queries

Because GraphQL gives clients the flexibility to query nested relationships, malicious clients can submit circular recursive queries that overwhelm the server's CPU and database:

# Malicious nested query attack
query {
  author {
    books {
      author {
        books { ... }
      }
    }
  }
}

Production Defenses

• Query Depth Limiting: Restrict query nesting depth to a maximum of 5 to 7 levels.
• DataLoader Batching: Consolidate individual resolver queries into single batched SQL statements to eliminate N+1 database query storms.