REST has a nice property: each endpoint has a roughly fixed cost. GraphQL throws that out. A single query can request arbitrarily deep and wide data, so two queries hitting the exact same schema can differ in resolution cost by orders of magnitude.
That flexibility cuts both ways. A tiny query string, whether crafted by an attacker or introduced by an accidental infinite nesting bug, can force a server to resolve millions of objects. This is why every major GraphQL server library ships some form of complexity analysis, and why knowing a query's cost before it hits production actually matters.
The core mechanic is simpler than it sounds: every field starts at a base cost of 1, list fields (anything with a first/last/limit argument, or that just looks like a collection) become multipliers, and a field's final cost is the product of every list ancestor above it. Nesting compounds fast. One deeply nested list field with a couple of first:N arguments stacked on top of each other can dominate the entire score.
I built QueryWeight to make this visible without doing the math by hand. Paste a query, get the AST-parsed depth, complexity score, unbounded list flags, and a ranked breakdown of what's actually driving the number, all computed client-side with zero network calls.
Full breakdown of the scoring model and how to read the results here: https://devencyclopedia.com/tools/queryweight
Top comments (0)