Prev Next

API / APIGEE Gateway Interview Questions

What is GraphQL proxy support in Apigee?

Apigee supports GraphQL APIs through the GraphQL policy, which validates incoming GraphQL requests against a schema and enforces limits on query depth and field count. This prevents common GraphQL-specific attacks such as deeply nested queries that could overwhelm a backend.

<!-- GraphQL policy: validate and protect GraphQL requests -->
<GraphQL name="GQL.Validate">
  <Action>parse</Action>
  <!-- Reference the uploaded GraphQL schema -->
  <ResourceURL>graphql://schema.graphql</ResourceURL>
  <!-- Protect against deeply nested queries -->
  <MaxDepth>10</MaxDepth>
  <!-- Limit number of fields per query to prevent data scraping -->
  <MaxCount>100</MaxCount>
</GraphQL>

<!-- Supported operations:
  parse     - validates the GraphQL query syntax and schema compliance
  verify    - validates that the operation is in the schema

  The policy catches:
  - Malformed GraphQL syntax
  - Operations not in the schema
  - Queries exceeding MaxDepth (circular/deep nesting attacks)
  - Queries exceeding MaxCount (field count explosion) -->

<!-- Typical proxy structure for GraphQL:
  Client -> POST /graphql (query in body)
  ProxyEndpoint:
    PreFlow:
      - VerifyAPIKey  (or OAuthV2 VerifyToken)
      - SpikeArrest
      - GQL.Validate  <- GraphQL-specific validation
  TargetEndpoint -> GraphQL backend service

  Note: Apigee proxies GraphQL as HTTP POST -
  standard HTTP policies (auth, rate limiting) all apply normally -->

What two GraphQL-specific attack vectors does the Apigee GraphQL policy's MaxDepth and MaxCount settings protect against?
At what level does the Apigee GraphQL policy validate incoming requests?

Invest now in Acorns!!! 🚀 Join Acorns and get your $5 bonus!
Acorns Logo

Invest now in Acorns!!! 🚀
Join Acorns and get your $5 bonus!

Earn passively and while sleeping

Acorns is a micro-investing app that automatically invests your "spare change" from daily purchases into diversified, expert-built portfolios of ETFs. It is designed for beginners, allowing you to start investing with as little as $5. The service automates saving and investing. Disclosure: I may receive a referral bonus.

Robinhood Logo

Invest now!!! Get Free equity stock (US, UK only)!

Use Robinhood app to invest in stocks. It is safe and secure. Use the Referral link to claim your free stock when you sign up!.

The Robinhood app makes it easy to trade stocks, crypto and more.


Webull Logo

Webull! Receive free stock by signing up using the link: Webull signup.

More Related questions...

What is Apigee and what problem does it solve for organisations? What are the deployment models available in Apigee? What is an API proxy in Apigee and what are its main components? What are Flows in Apigee and what is the request/response processing pipeline? What are Apigee Policies and what categories are available? What is the VerifyAPIKey policy and how does basic API key security work in Apigee? How does OAuth 2.0 work in Apigee and what grant types are supported? What is the difference between Quota and SpikeArrest policies in Apigee? What is an API Product in Apigee and how does it differ from an API Proxy? What is the Apigee organisation hierarchy and what are Environments? What are Shared Flows in Apigee and when do you use them? What is response caching in Apigee and how do you configure the ResponseCache policy? What is the AssignMessage policy and what can it do? What is the ExtractVariables policy and how does it work with flow variables? What is the ServiceCallout policy and when would you use it? What are Key Value Maps (KVMs) in Apigee and how do you use them? How does fault handling and error management work in Apigee? What is Target Server configuration in Apigee and why is it used instead of hardcoding backend URLs? What analytics capabilities does Apigee provide? What is the Apigee Developer Portal and how does it support the developer experience? How does JWT validation work in Apigee? What is the MessageLogging policy in Apigee and how is it used for audit and debugging? How does Apigee handle CORS (Cross-Origin Resource Sharing)? What is the Apigee hybrid architecture in more depth, including its components? What are Environment Groups and how does routing work in Apigee? How does TLS and mutual TLS (mTLS) work in Apigee? What is the Access Control policy in Apigee and how do you allowlist/denylist IPs? How do the JSONToXML and XMLToJSON policies work in Apigee? What is GraphQL proxy support in Apigee? What is Apigee CI/CD and how do you deploy proxies in a pipeline? What is RBAC (Role-Based Access Control) in Apigee and what are the built-in roles? What is Advanced API Security in Apigee and how does it detect bot attacks? What is Apigee API Hub and how does it relate to Apigee gateway? How does load balancing and health checking work on Apigee TargetEndpoints? What is the Apigee Debug / Trace tool and how do you use it for troubleshooting? How do you import an OpenAPI specification into Apigee to generate a proxy? What is Apigee monetisation and how does it work? What are Apigee flow variables and how do you work with them? How does Apigee compare to other API gateways such as Kong, AWS API Gateway, and MuleSoft? What are common Apigee anti-patterns and best practices for production deployments?
Show more question and Answers...

BigData

Comments & Discussions