What GraphQL complexity attacks do
In GraphQL architectures, clients specify the exact shape and relational depth of the response. Adversaries take advantage of this by submitting deeply nested circular queries (e.g., author → posts → author → posts) or batching exponential field multipliers into a single HTTP POST request. Without strict validation, a single 1 KB request can consume seconds of CPU time and exhaust database connection pools.
How ddos-simulation.com simulates it safely
ddos-simulation.com generates parameterized, valid GraphQL payloads with progressive depth and complexity tiers against your verified domain. The simulation strictly monitors origin health, response codes, and latency, aborting the test automatically if error rates exceed your configured safety threshold.
Authorized targets onlyAll simulations require domain ownership verification prior to execution. Testing is bounded by strict rate limits and active monitoring.
What the test exercises
- AST query depth validation filters
- Static query complexity cost calculators
- Field limiters and pagination bounds
- Database resolver pool saturation and query timeouts
- Gateway-level query whitelisting / persisted query enforcement
When to run a GraphQL complexity test
- Deploying public or partner-facing GraphQL schemas.
- Validating rate-limiting and query-cost middleware in Apollo Server, Yoga, Hasura, or API gateways.
- Benchmarking API gateway proxy throughput under adversarial payload structures.
How to run the test
- Verify your domain in the management portal.
- Add
graphql_complexity_check to your test timeline, specifying the endpoint path (e.g. /graphql) and target port. - Configure health checks to monitor upstream HTTP status and response times.
- Launch the test and inspect latency metrics in real time.
Configure a GraphQL test in the portal →
Reading the results
Resilient: The server rejects overly complex queries immediately with HTTP 400 / GRAPHQL_VALIDATION_FAILED in sub-millisecond time, preserving database resources.
Under strain: Queries hang until gateway timeout (HTTP 504), CPU utilization spikes on Node.js/Go processes, and database connections are exhausted.
Frequently asked questions
How does GraphQL query complexity cause a denial of service?
A single crafted query requesting recursive relational entities can trigger thousands of nested database lookups and high memory allocations in the JSON serializer.
What mitigations are most effective?
Enforce query depth limits (typically depth ≤ 5–7), static query cost calculation (e.g. graphql-cost-analysis), and persisted / whitelisted queries in production.
Rehearse GraphQL resilience against infrastructure you own — bounded, monitored, and safe.
Build a test plan