3 ms·
> Note that even if you use graphql for a private api to your web client, folks will reverse engineer it and use it for their own purposes. There are no private
by pan69 4y ago
> Note that even if you use graphql for a private api to your web client, folks will reverse engineer it and use it for their own purposes. There are no private apis on the web.
How is this a GraphQL specific problem?
- crabmusket 4y agoIt's not, but the OP is saying this to pre-empt the "just use GraphQL for private APIs" defence.
- agucova 4y agoAt least compared to classical REST, usually access is limited to whatever the programmer explicitly chose to add, instead of being open by default.
- Aeolun 4y agoThat’s weird. You explicitly choose what to add to your GraphQL API too. If you’re just setting up a random library that exposes your entire database, that’s no fault of GraphQL.
- mbfg 4y agoI think it's a marketing problem. GraphQL can easily sound like "Give the entire schema to your users and let them decide what to query for". If you look at various GraphQL supportive websites, that is a common anthem. You don't get that marketing from REST. REST says "decide what's good for them". Obviously you can do either in either. But i definitely think the marketing is world's apart. So when people come to a problem, if they are not super strong in their understanding of what will be a good solution, they generally implement what the platform markets.
- dhritzkiv 4y agoYeah, I caught that too. A lot of comments sounds like they're relying on Prisma/Husara/etc. to map directly to the database. I'm sure it's fine for some use cases (such as when prototyping), but I prefer to design and build out GraphQL APIs with a more UI/product-centric approach, which hide most of the database details.