Large number of payloads can degrade server performance

[robrichard]

Context

Requesting a large number of defer or stream payloads can degrade server performance. This is a potential denial of service vector.

Example:

query {
  list {
    ...@defer {
      stuff
    }
  }
}

If list contains a very large amount of items, there will be one deferred payload for each list item.

Decision

This was discussed at the Dec 2022 primary WG meeting and there was general consensus that the spec should contain strong recommendations to ignore/inline defer/stream in certain cases to limit an explosion in number of payloads. The exact recommendations have not yet been decided but will likely by some kind of recommendation around depth (ignore defers/streams under another defer/stream) and/or the total number of defer/streams (ignore any defer/streams encountered after N have already been executed).