These GraphQL interview questions cover schemas, resolvers, the N+1 problem, Apollo Server/GraphQL Yoga, and authentication in Node.js APIs.
15 GraphQL Interview Questions with Answers
Use the short version first, then offer trade-offs if the interviewer wants depth.
1. What problems does GraphQL solve compared to REST?
GraphQL lets clients specify nested fields in one request, reducing over-fetching and under-fetching common with fixed REST payloads. A strongly typed schema serves as contract and documentation. Trade-offs include caching complexity at the HTTP layer and need for query cost controls on the server.
2. Describe the main parts of a GraphQL schema.
Types define objects (User), scalars (String, Int), enums, interfaces, and unions. Query is the read root; Mutation writes data; Subscription streams events. Each field on a type can have arguments. Resolvers back fields that are not scalar defaults, connecting schema to databases and services.
3. What is a resolver and what arguments does it receive?
A resolver function fetches the value for a schema field. Signature is (parent, args, context, info): parent is the result from the parent field resolver; args are field arguments; context holds shared per-request services like db and auth user; info contains AST details for advanced use. Return values or Promises map to schema types.
4. What is the N+1 problem in GraphQL?
Fetching a list of N items then resolving a related field with one query per item yields N+1 database round trips—e.g., 100 posts each loading author separately. Fix with batching (DataLoader), JOIN queries in a list resolver, or lookahead optimization. Always measure resolver-level query counts.
5. How does DataLoader work?
DataLoader collects keys during one tick of the event loop and calls a batch load function once with all keys, returning results in order. Per-request loader instances prevent cache bleed across users. It converts many findAuthor(id) calls into one WHERE id IN (...).
6. How do you authenticate GraphQL requests in Node.js?
Parse JWT or session from Authorization header or cookie in context creation middleware, attach user to context, and enforce auth in resolvers or schema directives (@auth on fields). Return UNAUTHENTICATED errors for missing identity and FORBIDDEN for insufficient permissions. Do not rely on client-side hiding of fields alone.
7. Compare Apollo Server and GraphQL Yoga.
Apollo Server is widely adopted with plugins, federation support, and Apollo ecosystem integrations. GraphQL Yoga (The Guild) emphasizes standards, built-in subscriptions, file uploads, and flexible Envelop plugins. Both run on Node HTTP frameworks; choice often depends on federation needs and plugin preferences.
8. What are GraphQL mutations and idempotency considerations?
Mutations represent writes with side effects—createOrder, updateProfile. Unlike GET in REST, all GraphQL operations POST to one endpoint. Design mutations with explicit input types and return payload types with userErrors arrays. Use idempotency keys for payment-like operations because retries may resubmit the same mutation.
9. How do you handle errors in GraphQL?
Partial data can return with an errors array containing message, path, and extensions (code). Use Apollo's formatError to strip internal stack traces in production. Distinguish validation errors, auth errors, and downstream service failures in extensions.code for client handling.
10. What is query complexity / depth limiting and why use it?
Malicious or naive clients can request deeply nested or wide queries that overload the server. Assign costs to fields, limit depth and complexity, or use persisted queries allowlists. Rate limit by IP or token in addition to schema-level guards.
11. Explain GraphQL subscriptions.
Subscriptions stream events to clients over WebSockets (often graphql-ws protocol). The server publishes when data changes—new message, live score. Implement with pub/sub backends like Redis. Subscriptions share auth and context concerns with queries but require managing connection lifecycle and scaling websocket servers.
12. What is schema stitching vs Apollo Federation?
Stitching merges multiple schemas into one gateway with manual type merging. Federation (@key directives) lets subgraphs declare entity ownership and extend types across services with a supergraph router resolving references. Federation is the modern approach for microservices GraphQL at scale.
13. Should you put business logic in resolvers or services?
Keep resolvers thin: validate args, call service layer, map errors to GraphQL errors. Services hold transactions, authorization rules, and database access—testable without GraphQL harness. Fat resolvers become untestable and duplicate logic across mutations and REST adapters.
14. How does caching differ from REST CDN caching?
HTTP cache keys on URL and method; GraphQL POST bodies vary per query. Client-side normalized caches (Apollo Client, urql) store entities by __typename and id. Server-side use response caching plugins for public read-heavy fields or @cacheControl directives with careful TTL and invalidation strategy.
15. What is the difference between null and undefined in resolver returns?
Returning null for a non-null field (!) bubbles a GraphQL error and nulls the parent per spec. Undefined may be treated as null for nullable fields. Explicitly return null or throw GraphQLError for expected failures on non-null chains to avoid ambiguous partial results.
Pro Tip
When discussing REST vs GraphQL, acknowledge caching and file upload trade-offs—it shows balanced engineering judgment, not advocacy.