GraphQL API Development Rules

graphqlapisecuritybackend

Rules for building production-grade GraphQL APIs with security and performance in mind

Целевые файлы

Файл	Формат
.cursorrules	plaintext
CLAUDE.md	markdown

Содержимое

Enable query complexity and depth limits to prevent denial-of-service via expensive queries. Require authentication on all mutations and sensitive queries via context middleware. Return structured errors with code, message, and path; never expose stack traces to clients. Use field-level authorization: check permissions inside resolvers, not only at route level. Implement rate limiting per IP and per authenticated user on the GraphQL endpoint. Disable introspection in production environments to limit schema exposure. Use subscriptions only for real-time requirements; prefer polling for infrequent updates. Log every query and mutation with duration, user ID, and operation name for observability. Version breaking changes through field deprecation with a migration window of ${deprecation_days} days. Apply query whitelisting (persisted queries) in production to prevent arbitrary query execution. Never expose internal database IDs; use opaque cursors or base64-encoded global IDs. Test all resolvers with both valid and invalid inputs; cover authorization paths explicitly. Monitor resolver performance; add DataLoader batching when N+1 patterns are detected. Document schema changes in a CHANGELOG; communicate deprecations to API consumers.

Переменные

ID	Метка	По умолчанию	Варианты
deprecation_days	Deprecation window in days	90	—

CLI

npx mindaxis apply graphql-api-rules --target cursor --scope project

Используется в паках

Не используется ни в одном паке

← Правила