How would you implement query complexity analysis or depth limiting in a GraphQL API to prevent a maliciously deep or expensive query from overwhelming the server?

Because GraphQL lets clients compose arbitrarily deep and nested queries (potentially combined with an N+1-triggering pattern across many levels), a malicious or careless client could construct a query that's computationally very expensive to resolve -- query complexity analysis assigns a cost to each field (based on factors like expected result size) and rejects queries exceeding a configured total budget before execution even begins, while depth limiting simply caps how many levels of nesting a query is allowed to have, both providing protection against this specific denial-of-service vector unique to GraphQL's flexible querying model.

const depthLimit = require('graphql-depth-limit');
const { createComplexityLimitRule } = require('graphql-validation-complexity');

const server = new ApolloServer({
  typeDefs, resolvers,
  validationRules: [depthLimit(5), createComplexityLimitRule(1000)],
});