What is query depth limiting in GraphQL?

Query depth limiting is a security measure that rejects queries exceeding a maximum nesting depth. Without it, a malicious client can send a deeply nested query like { user { friends { friends { friends { ... } } } } } that causes exponential resolver work and potential server exhaustion (a DoS attack). A depth limit of 5-10 levels is typical. Libraries like graphql-depth-limit implement this as a validation rule. It is part of a defense-in-depth strategy alongside query complexity analysis and rate limiting. The depth is calculated statically on the query document before any resolvers run, making it an efficient early rejection.