How do you protect a GraphQL endpoint from abusive queries?

Because clients can compose arbitrarily deep and wide queries, a single request can exhaust the database.

Defences:

• Limit query depth, for example reject anything deeper than ten levels.
• Assign a cost to each field and reject queries whose total exceeds a budget, charging more for list fields and expensive joins.
• Require persisted queries so only pre-approved operations run in production, which also shrinks payloads.
• Disable or restrict introspection in production, and apply per-client rate limits and timeouts.
• Cap pagination arguments and reject requests without a limit.

const server = new ApolloServer({
  validationRules: [depthLimit(10), createComplexityLimitRule(1000)],
});

Combine these with database query timeouts and monitoring so a bad query is cut off before it degrades shared resources. Depth alone is insufficient because a shallow query can still request huge lists.