Performance & Safety
Bound what a client can ask for with depth limits, cost analysis, persisted queries and caching.
Depth limits and query cost analysis
Bounding what a client can ask for: depth, token and alias limits, a list-aware cost model computed by hand and on both stacks, the budget and its boundary, graphql-java's complexity instrumentation against a Strawberry execution extension, the per-field clamp, skipped selections, fragment pricing, batch refusal, and the caps that remain.
Persisted queries and APQ
Replacing query text with a SHA-256 hash: Apollo's three-step APQ handshake, hashes that do not match their text, persisted queries over GET and the mutation that must stay off it, trusted documents as an allowlist, and where each stack resolves the document: a Vert.x route in front of SmallRye, a SchemaExtension in Strawberry.
Caching
Four places to keep an answer: the client's normalized cache, an HTTP cache that persisted GET URLs make possible, field-level caches under the server's loaders, and the sources. Cache-Control decided per response, an nginx edge that bypasses on Authorization, TTLs, invalidation on registerHandlingEvent, and why the identity of the caller belongs in every key.