3 ms·
Let me rephrase that: you are exposing a way to trivially traverse the entire object graph you're exposing through the API, putting you at risk of DOSing your s
by mercurial 11y ago
Let me rephrase that: you are exposing a way to trivially traverse the entire object graph you're exposing through the API, putting you at risk of DOSing your server when your friend Joe the frontend dev makes a small mistake in his query. You can obviously get the same result with REST, but usually you have to work a lot harder for it.
- andrewingram 11y agoThis is actually solvable. The queries that will be executed by an app can be analysed statically, and therefore are available as part of a build pipeline. So it's possible to create a whitelist of queries automatically, or even go one step further and give each query a short unique ID and just say "execute query foo with these parameters" rather than sending the actual body of the query over the network.
- mercurial 11y agoYeah, but at that point the quantity of magic will start to make me uncomfortable.
- aikah 11y agoWhen a solution requires this kind of hacks for a simple task as rate limiting, maybe the solution is a bad one to begin with. With REST it is fairly easy to do rate limiting on endpoints. With GraphQL, it is fairly easy to DDOS with a complex query that will ask the server to fetch an insanely complex data structure. And there are no endpoints anymore.