# Securing Your GraphQL API from Malicious Queries

DevFeed: [Securing Your GraphQL API from Malicious Queries](<https://devfeed.tech/articles/securing-your-graphql-api-from-malicious-queries-23513.md>)

Original publisher: [Read original article](<https://www.apollographql.com/blog/securing-your-graphql-api-from-malicious-queries>)

Author: Max Stoiber

Published: 2018-02-21T21:45:32Z

Content type: tutorial

Language: en

Sources: [Apollo Blog](<https://devfeed.tech/sources/apollo-blog.md>)

Topics: [GraphQL](<https://devfeed.tech/topics/graphql.md>), [API](<https://devfeed.tech/topics/api.md>), [Security](<https://devfeed.tech/topics/security.md>), [DDoS](<https://devfeed.tech/topics/ddos.md>), [Database](<https://devfeed.tech/topics/database.md>), [Network](<https://devfeed.tech/topics/network.md>), [Server](<https://devfeed.tech/topics/server.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [database](<https://devfeed.tech/tags/database.md>), [graphql](<https://devfeed.tech/tags/graphql.md>), [network](<https://devfeed.tech/tags/network.md>), [security](<https://devfeed.tech/tags/security.md>), [server](<https://devfeed.tech/tags/server.md>)

## AI overview

This article explains how malicious, expensive nested GraphQL queries can overload a server, database, or network and cause a denial-of-service attack. It examines query-size limits and query whitelisting, including the tradeoffs of maintaining approved queries and supporting public API access.

## Source excerpt

With GraphQL you can query exactly what you want whenever you want. That is amazing for working with an API, but also has complex security implications. Instead of asking for legitimate, useful data, a malicious actor could submit an expensive, nested query to overload your server, database, network, or all of these. Without the right protections you open yourself up to a DoS (Denial of Service) attack.