GraphQL response caching is harder than URL-based REST caching because many operations can request the same resource shape. Normalize entity caches on the client, use persisted queries to restrict accepted documents, and cache resolver results only when authorization and freshness rules permit it.
Query depth, complexity, and rate limits protect the server from deliberately expensive nested operations.