The graphql tutorial has a chapter devoted to this: https://www.howtographql.com/advanced/4-security/ https://www.howtographql.com/advanced/4-security/ In a nu

The graphql tutorial has a chapter devoted to this: https://www.howtographql.com/advanced/4-security/ https://www.howtographql.com/advanced/4-security/ In a nutshell, you can limit the depth to which a query will resolve in order to prevent abuse. You can also go much further and whitelist a specific set of queries (which comes with some additional bandwidth wins!) See https://dev-blog.apollodata.com/persisted-graphql-queries-with-apollo-client-119fd7e6bba5 https://dev-blog.apollodata.com/persisted-graphql-queries-wi...