How do you implement query complexity analysis to prevent expensive GraphQL queries in NestJS?

Q: How do you implement query complexity analysis to prevent expensive GraphQL queries in NestJS?

// npm i graphql-query-complexity import { fieldExtensionsEstimator, simpleEstimator, getComplexity, } from 'graphql-query-complexity'; GraphQLModule.forRoot ({ driver: ApolloDriver, autoSchemaFile: true, plugins: [ { requestDidStart: () => ({ didResolveOperation({ request, document, schema }) { const complexity = getComplexity({ schema, operationName: request.operationName, query: document, variables: request.variables, estimators: [ fieldExtensionsEstimator(), // uses @Complexity() decorator simpleEstimator({ defaultComplexity: 1 }), // fallback: 1 per field ], }); if (complexity > 100) { throw new GraphQLError( `Query complexity ${complexity} exceeds maximum of 100`, { extensions: { code: 'QUERY_TOO_COMPLEX', complexity } }, ); } }, }), }, ], }) // Annotate expensive fields @ObjectType() export class User { @Field(() => [Post]) @Complexity(({ childComplexity }) => 10 + childComplexity * 2) posts: Post[]; // costs 10 + 2 per requested sub-field } Reject queries before execution — complexity analysis runs in didResolveOperation, before any resolvers fire. simpleEstimator assigns a default cost of 1 per field — a good baseline for most fields. fieldExtensionsEstimator reads @Complexity() decorators for field-specific costs. List fields should have higher costs than scalar fields — they multiply with child complexity. Start with a high limit (e.g. 1000) in development and tune down as you measure real query costs.

Difficulty: 7/10

query complexity, NestJS middleware, GraphQL security

Use graphql-query-complexity with an Apollo plugin registered in GraphQLModule.forRoot(). The plugin calculates total query complexity before execution and throws a GraphQLError if it exceeds the limit. Annotate expensive fields with @Complexity() to assign custom costs based on child complexity.

Query complexity analysis with Apollo plugin

Query complexity analysis guidelines:

1
Reject queries before execution — complexity analysis runs in didResolveOperation, before any resolvers fire.

How do you implement query complexity analysis to prevent expensive GraphQL queries in NestJS?

Difficulty: 7/10

query complexity, NestJS middleware, GraphQL security

Use graphql-query-complexity with an Apollo plugin registered in GraphQLModule.forRoot(). The plugin calculates total query complexity before execution and throws a GraphQLError if it exceeds the limit. Annotate expensive fields with @Complexity() to assign custom costs based on child complexity.

Query complexity analysis with Apollo plugin

Query complexity analysis guidelines:

1
Reject queries before execution — complexity analysis runs in didResolveOperation, before any resolvers fire.

How do you implement query complexity analysis to prevent expensive GraphQL queries in NestJS?

Use graphql-query-complexity with an Apollo plugin registered in GraphQLModule.forRoot(). The plugin calculates total query complexity before execution and throws a GraphQLError if it exceeds the limit. Annotate expensive fields with @Complexity() to assign custom costs based on child complexity.

How do you implement query complexity analysis to prevent expensive GraphQL queries in NestJS?

Use graphql-query-complexity with an Apollo plugin registered in GraphQLModule.forRoot(). The plugin calculates total query complexity before execution and throws a GraphQLError if it exceeds the limit. Annotate expensive fields with @Complexity() to assign custom costs based on child complexity.

Scenario Questions

Follow-up Questions