Class QueryComplexityLimits

java.lang.Object
graphql.validation.QueryComplexityLimits
@PublicApi @NullMarked public class QueryComplexityLimits extends Object
Configuration class for query complexity limits enforced during validation. This provides a lightweight alternative to ExecutableNormalizedOperation (ENO) for tracking query depth and field count.

By default, validation enforces limits (maxDepth=100, maxFieldsCount=100000). To customize limits per-request, put a custom instance in the GraphQLContext: 

QueryComplexityLimits limits = QueryComplexityLimits.newLimits()
    .maxDepth(10)
    .maxFieldsCount(100)
    .build();

ExecutionInput executionInput = ExecutionInput.newExecutionInput()
    .query(query)
    .graphQLContext(ctx -> ctx.put(QueryComplexityLimits.KEY, limits))
    .build();

To disable limits for a request, use NONE: 

executionInput.getGraphQLContext().put(QueryComplexityLimits.KEY, QueryComplexityLimits.NONE);

To change the default limits globally (e.g., for testing), use setDefaultLimits(QueryComplexityLimits): 

QueryComplexityLimits.setDefaultLimits(QueryComplexityLimits.NONE); // disable for tests

  • Field Details

    • DEFAULT_MAX_DEPTH

      public static final int DEFAULT_MAX_DEPTH
      Default maximum query depth.
      See Also:

    • DEFAULT_MAX_FIELDS_COUNT

      public static final int DEFAULT_MAX_FIELDS_COUNT
      Default maximum field count.
      See Also:

    • KEY

      public static final String KEY
      The key used to store QueryComplexityLimits in GraphQLContext.
      See Also:

    • DEFAULT

      public static final QueryComplexityLimits DEFAULT
      Standard limits (maxDepth=100, maxFieldsCount=100000).

    • NONE

      public static final QueryComplexityLimits NONE
      No limits (all limits set to Integer.MAX_VALUE). Use this to disable complexity checking.

  • Method Details

    • setDefaultLimits

      public static void setDefaultLimits(QueryComplexityLimits limits)
      Sets the default limits used when no limits are specified in GraphQLContext. This is useful for testing or for applications that want different global defaults.
      Parameters:
      limits - the default limits to use (use NONE to disable, DEFAULT to restore)

    • getDefaultLimits

      public static QueryComplexityLimits getDefaultLimits()
      Returns the current default limits.
      Returns:
      the default limits

    • getMaxDepth

      public int getMaxDepth()
      Returns:
      the maximum allowed depth for queries, where depth is measured as the number of nested Field nodes

    • getMaxFieldsCount

      public int getMaxFieldsCount()
      Returns:
      the maximum allowed number of fields in a query, counting fields at each fragment spread site

    • newLimits

      public static QueryComplexityLimits.Builder newLimits()
      Returns:
      a new builder for creating QueryComplexityLimits

    • toString

      public String toString()
      Overrides:
      toString in class Object