API / APIGEE Gateway Interview Questions
What is GraphQL proxy support in Apigee?
Apigee supports GraphQL APIs through the GraphQL policy, which validates incoming GraphQL requests against a schema and enforces limits on query depth and field count. This prevents common GraphQL-specific attacks such as deeply nested queries that could overwhelm a backend.
<!-- GraphQL policy: validate and protect GraphQL requests --> <GraphQL name="GQL.Validate"> <Action>parse</Action> <!-- Reference the uploaded GraphQL schema --> <ResourceURL>graphql://schema.graphql</ResourceURL> <!-- Protect against deeply nested queries --> <MaxDepth>10</MaxDepth> <!-- Limit number of fields per query to prevent data scraping --> <MaxCount>100</MaxCount> </GraphQL> <!-- Supported operations: parse - validates the GraphQL query syntax and schema compliance verify - validates that the operation is in the schema The policy catches: - Malformed GraphQL syntax - Operations not in the schema - Queries exceeding MaxDepth (circular/deep nesting attacks) - Queries exceeding MaxCount (field count explosion) --> <!-- Typical proxy structure for GraphQL: Client -> POST /graphql (query in body) ProxyEndpoint: PreFlow: - VerifyAPIKey (or OAuthV2 VerifyToken) - SpikeArrest - GQL.Validate <- GraphQL-specific validation TargetEndpoint -> GraphQL backend service Note: Apigee proxies GraphQL as HTTP POST - standard HTTP policies (auth, rate limiting) all apply normally -->
More Related questions...