Sign in Get started

GraphQL in Production · Capstone

Capstone: Harden a Public GraphQL Endpoint

Find and fix the security and performance gaps in an existing GraphQL deployment.

Scenario

A startup exposed its GraphQL API publicly. Observed problems: CPU spikes from deeply nested friends queries, a credential-stuffing attack using 500 aliased login mutations per request, competitors scraping data via introspection-discovered fields, and dashboards showing POST /graphql 200 for everything during an outage.

Requirements

  • Mitigate each incident
  • Keep the public developer experience reasonable
  • Make incidents observable

Constraints

  • Some partners rely on introspection-based tooling
  • No downtime during rollout

Deliverables

  1. Propose concrete mitigations for each problem.
  2. How do you roll these changes out without breaking partners?

Draft each deliverable below before revealing the model answer and rubric.

Further reading: OWASP GraphQL Cheat Sheet

Deliverables

Propose concrete mitigations for each problem.

Model answer

  • Nested queries: depth limit (8), cost analysis with list multipliers, max first, execution timeouts
  • Aliased login: limit operations/aliases per request, rate-limit login per account and IP by operation count, move auth to a dedicated REST/OAuth endpoint
  • Scraping: disable introspection for anonymous traffic; provide schema via registry/docs to authenticated partners; cost-based rate limits per API key; field-level auth for sensitive data
  • Observability: metrics by operation name, error codes from errors[], field timings; alert on error ratio per operation

Rubric

Look for layered defenses and cost-based limits. Disabling introspection alone is not sufficient (security through obscurity).

How do you roll these changes out without breaking partners?

Model answer

Run limits in log-only mode first, measure which operations would be rejected, contact affected partners, provide persisted-document registration for partners with heavy queries, then enforce gradually per client tier.

Rubric

Strong answers use shadow mode + data before enforcing, and give partners a migration path.

Open in the app to mark lessons complete, take notes and track your progress.