Q47: What is Hard/Strict Persisted Queries (Query Whitelisting)?

Difficulty:ExpertTopic:Security

Unlike APQ (which registers new queries dynamically at runtime), Strict Persisted Queries requires build-time registration of all client queries. The production GraphQL server rejects any incoming query string or hash that is not present in its pre-approved production whitelist.

Key Takeaways
  • Query Whitelisting completely disables arbitrary query execution in production environments.
Knowledge Check

What is the primary security advantage of Strict Query Whitelisting?