Registry / security / graphql-depth-limit

graphql-depth-limit

library1.1.0jsnpmunverified

A GraphQL validation rule that limits the total depth of incoming queries to prevent cyclical or excessively deep queries that could cause denial-of-service attacks. Version 1.1.0 is the latest stable release. Maintained as needed (no recent commits). Compared to alternatives like graphql-query-complexity or graphql-validation-complexity which assign per-field or per-type costs, this library uses a simpler depth-based metric that can catch exponential complexity growth, e.g. from repeated joins. Works with any GraphQL server that supports validation rules, such as express-graphql and koa-graphql.

security testing

npm install graphql-depth-limit

github ↗package ↗homepage ↗

INSTALL

IMPORT

SIG · GRAPHQL-DEPTH-LIMI

graphql-depth-limit

securityjavascriptv1.1.0

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

depthLimit

✓ import depthLimit from 'graphql-depth-limit'

✗ import { depthLimit } from 'graphql-depth-limit'

This package has a default export, not a named export. CommonJS: const depthLimit = require('graphql-depth-limit').default

depthLimit (CJS)

✓ const depthLimit = require('graphql-depth-limit').default

✗ const depthLimit = require('graphql-depth-limit')

In older Node versions without ESM, the default export is accessed via .default. This is a common footgun.

DepthLimitOptions

✓ import depthLimit, { DepthLimitOptions } from 'graphql-depth-limit'

DepthLimitOptions is a named export for the options object type (only needed in TypeScript).

Shows how to add graphql-depth-limit as a validation rule to an express-graphql server, limiting query depth to 10.

import depthLimit from 'graphql-depth-limit'; import express from 'express'; import { graphqlHTTP } from 'express-graphql'; import schema from './schema'; const app = express(); app.use('/graphql', graphqlHTTP((req, res) => ({ schema, validationRules: [ depthLimit(10) ] }))); app.listen(4000); console.log('Running a GraphQL API server at http://localhost:4000/graphql');

Debug

Known issues

gotchaThe validation only checks depth of fields, not the total number of nodes or complexity per field.

fix

Consider using graphql-query-complexity for more granular cost analysis if depth alone is insufficient.

affects: *

gotchaIntrospection fields (e.g., __schema, __type) are not ignored by default in versions <1.1.0.

fix

Upgrade to 1.1.0+ and pass { ignore: [ '__schema', '__type' ] } in options.

affects: <1.1.0

gotchaCommonJS require returns an object with a default property, not the function directly.

fix

Use require('graphql-depth-limit').default or switch to ESM imports.

affects: *

deprecatedThe second argument (options) previously accepted a callback for ignored fields; now an object with 'ignore' property.

fix

Use { ignore: ['fieldName'] } instead of a function.

affects: >=0.1.0 <1.0.0

Errors

Common errors & fixes

depthLimit is not a function

CommonJS require without .default

fix

const depthLimit = require('graphql-depth-limit').default;

Validation error: Query depth (11) exceeds the depth limit (10)

Query exceeds the configured max depth

fix

Increase the limit or restructure the query to be shallower.

Cannot find module 'graphql-depth-limit'

Package not installed

fix

npm install graphql-depth-limit

Upgrade

Version history

1.1.0latest on npm

Audit

Dependencies

graphqlrequiredpeer dependency — provides the GraphQL types and validation framework

Agent activity

17 hits · last 30 days

node

Resources

githubhttps://github.com/stems/graphql-depth-limit ↗

packagegraphql-depth-limit ↗

homepagehttps://github.com/stems/graphql-depth-limit#readme ↗