GraphQL Query Complexity Validation Discrepancy Between Local and Production Environments

Answer to the Question

When a GraphQL query succeeds in a local dev server but is rejected in production, the most common cause is that the validation rules applied in the two environments differ. Production deployments usually enable stricter checks such as DepthLimitRule, ComplexityRule, and custom rules that block introspection, whereas the local instance often runs with those rules omitted or with very high thresholds for developer convenience.

Likely Explanation

• Local builds may set maximumComplexity to 0 (unlimited) or use a very high number, while production uses a tighter limit.
• Depth limiting is often turned off locally or set to a high value; production typically enforces a maxDepth of 10–15.
• Custom rules that prevent introspection or other expensive operations are frequently only added to production.
• Environment‑specific configuration files or secrets can cause the same rule to be instantiated with different parameters.
• Some plugins (e.g., Playground, GraphiQL) may internally suppress or bypass complexity checks during development.

Confirmed Facts

• In apollo-server, the validation rule stack is empty unless validationRules is explicitly provided.
• Both graphql-depth-limit and graphql-query-complexity expose configuration options that are typically controlled via environment variables.
• Blocking introspection is a common custom rule that is usually added only in production deployments.
• Differences in .env files or cloud secret stores can lead to divergent rule parameters even when the same code base is used.

Steps Needed for This Case

1. Verify that the same set of validation rules is imported in both the local and production server entry points.
2. Check that the environment variables controlling maximumComplexity and maxDepth are sourced from the same location (e.g., a shared .env file or CI‑injected secrets).
3. Add verbose logging around validation failures in production so that the exact rule and threshold causing a rejection are recorded.
4. Run a small suite of representative queries against a staging build that mirrors the production rule set to confirm that no unexpected validation errors occur.

Missing Diagnostic Detail

Could you share the current values (or the environment‑variable names) used for maximumComplexity and maxDepth in both your local and production environments? Knowing those values will help determine whether the discrepancy is due to differing thresholds or to the presence/absence of specific validation rules.