Rate Limiting and Query Depth Protection
Protect your Spring Boot GraphQL API from abuse and denial-of-service by limiting how often clients can call and how deeply nested their queries can be.
Rate Limiting and Query Depth Protection is a free GraphQL APIs with Spring Boot lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the GraphQL APIs with Spring Boot learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Why GraphQL Needs Protection
A single GraphQL endpoint accepts arbitrarily complex queries. A malicious or careless client can request deeply nested data or hammer the server, exhausting resources.
Rate limiting and depth protection defend against these attacks.
The Nested Query Threat
Because GraphQL allows cyclic relationships, a client could ask for an author's books, each book's author, that author's books, and so on. This recursion can balloon into an enormous, expensive query.
query {
author {
books { author { books { author { name } } } }
}
}Limiting Query Depth
graphql-java provides MaxQueryDepthInstrumentation, which rejects any query that nests deeper than a set limit before execution begins.
@Bean
public Instrumentation depthLimit() {
return new MaxQueryDepthInstrumentation(10);
}Limiting Field Count
Beyond depth, a broad query can request thousands of fields. MaxQueryComplexityInstrumentation caps the total complexity score of a query.
@Bean
public Instrumentation complexityLimit() {
return new MaxQueryComplexityInstrumentation(200);
}What Is Rate Limiting?
Rate limiting caps how many requests a client may make in a time window. It prevents abuse and ensures fair resource sharing across clients.
The Token Bucket Idea
A common algorithm is the token bucket: each client has a bucket that refills at a steady rate. Every request consumes a token; if the bucket is empty, the request is rejected.
Rate Limiting with Bucket4j
The bucket4j library implements token buckets in Java. Configure a bucket with a refill rate and capacity.
Bandwidth limit = Bandwidth.simple(100, Duration.ofMinutes(1));
Bucket bucket = Bucket.builder().addLimit(limit).build();Enforcing the Limit
Before processing a request, try to consume a token. If none is available, return an error instead of executing the query.
if (!bucket.tryConsume(1)) {
throw new RateLimitException("Too many requests");
}Per-Client Buckets
Track a separate bucket per client, keyed by API key or authenticated user ID, so one heavy client cannot starve everyone else.
Bucket bucket = buckets.computeIfAbsent(userId, k -> newBucket());Combining Defenses
Layer your protections for full coverage:
- Depth limit stops recursive abuse
- Complexity limit stops broad expensive queries
- Rate limit stops request floods
- Timeouts stop slow runaway operations
Best Practices
Tune limits to your real traffic:
- Start strict, then relax based on monitoring
- Return clear errors so clients can back off
- Apply tighter limits to unauthenticated traffic
- Log rejected queries to spot abuse patterns
Quick Check
Test your API protection knowledge.
Recap
You hardened your GraphQL API:
- Depth and complexity instrumentation block expensive queries
- Rate limiting caps request frequency per client
- Token buckets (bucket4j) implement fair limits
- Layer depth, complexity, rate, and timeout defenses
These guards keep your API available and resilient under abuse.
Frequently asked questions
Is the “Rate Limiting and Query Depth Protection” lesson free?
Yes — the full text of “Rate Limiting and Query Depth Protection” is free to read here on the web, and the GraphQL APIs with Spring Boot course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the GraphQL APIs with Spring Boot course, upgrade to CoddyKit PRO.
What will I learn in “Rate Limiting and Query Depth Protection”?
Protect your Spring Boot GraphQL API from abuse and denial-of-service by limiting how often clients can call and how deeply nested their queries can be. You practise GraphQL APIs with Spring Boot with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start GraphQL APIs with Spring Boot?
No prior experience is required. GraphQL APIs with Spring Boot on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Rate Limiting and Query Depth Protection” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this GraphQL APIs with Spring Boot lesson?
Yes. Every GraphQL APIs with Spring Boot lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Custom Error Handling in GraphQL
- Authentication with Spring Security
- Authorization with Directives and Context
- Rate Limiting and Query Depth Protection