GraphQL persisted queries (hash allowlist)

GraphQL endpoints can be abused with huge queries that are expensive to parse and execute. Persisted queries let clients send a hash (e.g. sha256:...) instead of the full query, and the server only executes queries it recognizes. This reduces payload size, improves caching, and makes it easier to control what queries hit production. I like that it creates a reviewable surface area: you can audit the allowlist and know what’s running. The operational trick is rollout: accept full queries and hashes initially, then enforce hashes once clients are updated. Persisted queries aren’t a silver bullet, but they’re a pragmatic hardening step once GraphQL usage grows.