Apollo Federation (multi-service graph)
Each team owns a subgraph with @key entities. Gateway composes supergraph:
# Users subgraph
type User @key(fields: "id") {
id: ID!
name: String!
}
# Orders subgraph
extend type User @key(fields: "id") {
id: ID! @external
orders: [Order!]!
}Gateway plans query across services — _entities representation fetch for stitching.
Alternatives: GraphQL Mesh, Hasura (DB-to-GraphQL), tRPC for TS-only stacks (Topic 5).
Performance guardrails (production mandatory)
Without limits, one query can DDoS your DB:
| Guardrail | Purpose |
|---|---|
| Max depth | Prevent nested explosion |
| Complexity cost | Weight fields by DB cost |
| Timeout | Kill long queries |
| Persisted queries | Allowlist known queries (mobile apps) |
| Rate limit | Per API key / user |
Query cost analysis — assign cost to fields (orders: 10, reviews: 5); reject if total > budget.
Caching is hard
HTTP cache keys on URL — GraphQL uses same URL with different bodies. Strategies:
- APQ (Automatic Persisted Queries) — hash in URL
- CDN caching for public read-heavy graphs (rare, careful)
- Server-side entity cache (Redis) in resolvers
- @cacheControl directives (Apollo)
Default: assume no CDN edge cache for GraphQL; design in-app caching.
Subscriptions
Usually WebSocket: client subscribes to orderStatusUpdated. Server publishes events from Kafka/Redis pubsub. Operational complexity: connection fan-out, auth on WS, reconnect handling.
Deep Cuts covers advanced subscription scaling.
Anti-patterns staff call out
- GraphQL wrapping every microservice directly (no BFF) → resolver spaghetti
- Exposing DB tables 1:1 as types → leaky abstraction
- Mutations that trigger 20 downstream sync calls → use async events
- No query limits on public endpoint → incident waiting
Interview one-liner
"GraphQL optimizes developer experience and payload shape at the cost of caching, query control, and operational complexity — we use it at the BFF layer, not as our internal east-west protocol."
Further Reading
Hands-On Tasks (Optional)
API design drills and whiteboard exercises — protocol selection, contract design, and bulk-transfer architecture. Assumes Networking and sibling tracks on the hub page (Distributed Systems, Databases, Concurrency, LLD).
- Define query guardrails15m
Set max depth, max complexity cost, timeout, and persisted-query policy for a public GraphQL API. Explain how you'd detect and block abusive queries.