What is query depth limiting in GraphQL and why is it important?

Query depth limiting is a security measure that restricts how deeply nested a GraphQL query can be. Without it, a malicious actor can craft deeply nested queries that cause exponential data fetching: { users { friends { friends { friends { friends { ... } } } } } }. Each level multiplies the number of database calls. The graphql-depth-limit package adds a validation rule: depthLimit(7) rejects queries deeper than 7 levels. This should be combined with other protections: query complexity analysis (assign a cost to each field and reject queries exceeding a budget), query timeout, and rate limiting. The maximum safe depth depends on your schema — typically 5-10 levels. In production, always implement at minimum: depth limiting + complexity limiting + authentication rate limits. Disable introspection and field suggestions in production to reduce attack surface.