GraphQL's flexibility is also its resource risk: a client can craft a single query that fetches deeply nested relationships, generating hundreds or thousands of database calls from one HTTP request. Limit this at the query analysis stage — before execution begins.
Depth limit: Reject queries nested more than N levels deep (typically 5–7 for most APIs). Libraries: graphql-depth-limit (JS), graphene query complexity (Python).
Complexity score: Assign a cost to each field and reject queries whose total cost exceeds a threshold. Fields that trigger database calls cost more than scalar fields. Reject before the query runs.
Query whitelisting (only allow known-good queries in production), persisted queries (client registers queries by hash, server only runs registered queries), and disabling introspection in production (prevents attackers from exploring the schema to craft targeted heavy queries).
Ask whether your cloud cost monitoring would alert if API usage caused a sudden 10x spike in compute or data costs. An attacker running expensive operations at scale might go unnoticed until the bill arrives.