Implement strategy against denial of service attacks

[ojongerius]

If we are going to use GraphQL this will be a little more complicated than using REST.

Things to consider:

• Query depth
• Timeouts
• Query complexity
• Rate limiting based on server time vs query complexity

This article provides a good background:

https://github.com/howtographql/howtographql/blob/master/content/graphql/advanced/4-security.md

Githubs approach: https://developer.github.com/v4/guides/resource-limitations/

[ojongerius]

Relevant article on Spectrum's approach at https://dev-blog.apollodata.com/securing-your-graphql-api-from-malicious-queries-16130a324a6b TL;DR: minimally implement depth and amount limiting. Investigate query cost Analysis.