Protecting GraphQL APIs from malicious queries

What this post added

This post details the development of a custom GraphQL query parser for Cloudflare's API Gateway. The parser tokenizes GraphQL queries in a streaming fashion to achieve low latency (p95 < 50 microseconds) and minimal memory allocation, enabling the extraction of query size and depth attributes. These attributes are then exposed via Wirefilter fields (`cf.api_gateway.graphql.query_size`, `cf.api_gateway.graphql.query_depth`, `cf.api_gateway.graphql.parsed_successfully`) to allow customers to create security rules against malicious GraphQL queries, specifically addressing denial-of-service risks from deeply nested or overly broad queries.