Operation cost controls
Enforce bounded operation cost before and during execution using complexity and depth limits plus validation/execution timeouts.
When to use this practice
Use this when your server accepts arbitrary documents from untrusted clients (for example, third-party APIs, GraphiQL-like exploratory traffic, or third-party integrations).
Applies to
- GraphQL servers with open query surfaces
- Gateways and proxies with untrusted upstream traffic
- Security tooling
Why this is conditional
If your deployment enforces trusted documents and controlled releases, you may not need these controls in the default golden path. They remain useful as additional defense or for mixed-trust environments.
Solves
- Execution cost spikes
- Excessive query complexity
- Excessive query depth
- Parse-time denial of service
- DoS via validation
- DoS via runtime execution