Protect a flexible GraphQL API from queries and users that could abuse your backend.
GraphQL's flexibility creates security challenges that are different from traditional REST APIs. A client can potentially request deeply nested fields, send expensive queries, or discover information that should not be accessible if authorization is not handled correctly.
Security requires several layers, including authentication, field-level authorization, input validation, query complexity limits, depth limits, rate limiting, and careful control of introspection in production environments. The goal is to make sure a valid GraphQL query is also a safe query to execute.
What you'll walk away knowing