In GraphQL, when types reference eachother, it is often possible to build a circular query that grows exponentially to a point it could bring the server down to its knees. Countermeasures such as max_depth
can help mitigate these types of attacks.
The max_depth
functionality acts as a safeguard, and defines how deep a query can get, ensuring deeply constructed queries will not be accepted by GraphQL.
The application offers two types, namely Owner
and Paste
, which reference eachother (an owner has a paste, and a paste has an owner), allowing a recursive query to be executed successfully.