@@ -14,7 +14,7 @@ using static analysis. You'll learn how to estimate the cost
14
14
of an operation before execution and reject it if it exceeds a safe limit.
15
15
16
16
<Callout type = " info" emoji = " ℹ️" >
17
- In production, we recommend using [ trusted documents] ( https://graphql.org/learn/persistence/ )
17
+ In production, we recommend using [ trusted documents] ( /docs/going-to-production#only-allow-trusted-documents )
18
18
rather than analyzing arbitrary documents at runtime. Complexity analysis can still be
19
19
useful at build time to catch expensive operations before they're deployed.
20
20
</Callout >
@@ -28,7 +28,7 @@ at the schema.
28
28
Without safeguards, clients could:
29
29
30
30
- Request deeply nested object relationships
31
- - Use recursive fragments to multiply field resolution
31
+ - Use nested fragments to multiply field resolution
32
32
- Exploit pagination arguments to retrieve excessive data
33
33
34
34
Certain field types (e.g., lists, interfaces, unions) can also significantly
@@ -246,8 +246,8 @@ useful, just in a different way. You can run it at build time to:
246
246
247
247
## Best practices
248
248
249
- - Use trusted documents in production when possible.
250
- - Use complexity analysis as a development-time safeguards .
249
+ - Only accept trusted documents in production when possible.
250
+ - Use complexity analysis as a development-time safeguard .
251
251
- Avoid running untrusted operations without additional validation and cost checks.
252
252
- Account for list fields and abstract types, which can significantly increase cost.
253
253
- Avoid estimating complexity before validation unless you're confident in your tooling.
0 commit comments