GraphQL security & scalable way in AEM?

[AEMWizard]

I understand whenever someone is making a GraphQL query request to AEM, the publishers will be hit with some load time. What happens if someone decides to spam the GraphQL query request?

is there a secure way to safeguard the GraphQL query request from being spammed?

How about caching? How does AEM cache GraphQL query requests?

[Monendra_Singh · Accepted solution]

Hi @AEMWizard ,

Yes, you can safeguard your graphQL queries by implementing the following:

1. Rate Limiting: You can use rate limiting to limit the number of GraphQL query requests that can be made to your AEM instance within a certain timeframe.
2. Throttling: You can use throttling to limit the number of GraphQL query requests that can be made concurrently to your AEM instance
3. Captcha(For Bot protection only): You can use a Captcha to verify that the request is being made by a human, rather than a bot. 

You can also go for persisted graphQL option if you want to cache the query results.A persisted query is a GraphQL query that has been stored in a server-side cache. This allows clients to send an ID in place of the full query text, reducing the amount of data sent over the network and potentially improving performance. You can find more about it here - https://experienceleague.adobe.com/docs/experience-manager-learn/getting-started-with-aem-headless/g...

Thanks,

Monendra