Announcing GraphQL Rate Limiting: Protect Your GraphQL API from Bots and Hackers

Cool stuff, congrats on the launch!

I am excited to learn about the details for complexity-based rate limits, as there are quite a few design considerations involved. For example, how to configure which (numeric) arguments in a GraphQL query actually impact complexity. The example in the blogpost relies on `first`, which seems to be derived from Relay Connections. But implementations might differ and user other arguments.

We did research in this area (cf. https://arxiv.org/pdf/2009.05632.pdf) and proposed a specification to embed required configuration in the GraphQL schema (cf. https://ibm.github.io/graphql-specs/cost-spec.html).