Implementing GraphQL Gateway Features
1. Configuring GraphQL Schema Stitching
| Approach | Detail |
|---|
| Schema stitching LEGACY | Merge SDL at gateway |
| Apollo Federation v2 | Subgraphs with @key directives |
| GraphQL Mesh | Unify REST/gRPC/SOAP as GraphQL |
| Hasura Remote Schemas | Database + remote merge |
2. Using GraphQL Query Validation
| Validator | Check |
|---|
| Schema validation | Field/type existence |
| Operation type | query/mutation/subscription allowed |
| Argument types | Match schema |
| Directive usage | Custom @auth, @rate |
3. Implementing Query Complexity Analysis
Example: Cost-based complexity
const rule = createComplexityRule({
maximumComplexity: 1000,
variables: req.body.variables,
onComplete: (cost) => metrics.histogram("gql.cost").observe(cost),
estimators: [
fieldExtensionsEstimator(), // uses @complexity directive
simpleEstimator({ defaultComplexity: 1 })
]
});
4. Setting Query Depth Limits
| Limit | Recommended |
|---|
| Max depth | 7-10 |
| Max breadth | 20 fields per level |
| Max aliases | 15 (prevent dup attacks) |
| Max document size | 16 KB |
5. Configuring Batching and DataLoader
Example: DataLoader pattern
const userLoader = new DataLoader(async (ids) => {
const users = await db.users.findByIds(ids);
return ids.map(id => users.find(u => u.id === id));
});
// In resolver
const user = await userLoader.load(parent.userId);
// 100 calls in same tick → 1 DB query
6. Using Persisted Queries
| Benefit | Detail |
|---|
| Smaller request | Send hash, not full query |
| Allowlist | Only approved queries |
| Cacheable GET | CDN-friendly |
| APQ | Auto-register on first miss |
7. Implementing Subscription Support
| Transport | Notes |
|---|
graphql-ws | Modern, recommended |
subscriptions-transport-ws DEPRECATED | Legacy |
| SSE | One-way, simpler |
| Pub/Sub backend | Redis, Kafka, NATS |
8. Setting Up Introspection Control
| Env | Introspection |
|---|
| Development | Enabled |
| Staging | Enabled (auth required) |
| Production | Disabled or auth-gated |
Note: Disabling introspection in prod limits attacker recon. Provide schema via separate dev portal.
9. Configuring Apollo Federation
Example: Subgraph with @key
type User @key(fields: "id") {
id: ID!
name: String!
}
extend type Order @key(fields: "id") {
id: ID! @external
buyer: User! # resolved via reference
}
10. Using Schema Registry
| Tool | Use |
|---|
| Apollo Studio | Hosted, composition checks |
| GraphQL Hive | Open source registry |
| Hasura DDN | Federated data network |
| CI composition check | Block breaking changes |