Protecting GraphQL APIs from malicious queries

This post details the development of a custom, low-latency, no-heap-allocation GraphQL parser for Cloudflare's API Gateway. The parser tokenizes GraphQL queries to calculate query depth and size without building a full Abstract Syntax Tree, enabling the collection of these metrics for security analysis. It handles both JSON-encoded and raw GraphQL requests, using `serde_raw_value` for JSON parsing to avoid heap allocations. The parser achieves a p95 parsing time of 25 microseconds and introduces three new Wirefilter fields for customers to implement GraphQL-specific security rules.