4 ms·
I like GraphQL because it allows me to describe my API like a domain rather than just a collection of resources. REST is difficult to map to a true domain model
by twodave 4y ago
I like GraphQL because it allows me to describe my API like a domain rather than just a collection of resources. REST is difficult to map to a true domain model because domains aren't just collections of resources. They have nuance. And with GraphQL your API matches your domain, so there's no limit to what your application can accomplish. For example, adding another feature to your front-end no longer requires going back to your API to add a tailored endpoint nearly as often. At worst you're adding a property somewhere that is now available to all your use cases. GraphQL embraces mutations in a way that REST frankly can't without being glorified RPC, and it doesn't have the same perverse incentives such as re-using an endpoint because it exists even though it may be suboptimal.
So, in my opinion, unless your application is very resource/entity-intensive (and you don't mind a little RPC-style bloat) then GraphQL is often a better choice than REST. And if you actually have a rich domain to model (this is the case even for many small applications), then GraphQL is often a better choice than RPC.
- gofreddygo 4y agoI love graphql. It allowed me to scrape a whole bunch of websites with almost no changes to my scraper.
- berkle4455 4y agographql is a data exfiltration engine, it's lovely
- twodave 4y agoHow is this different than a REST API with an open api spec? I suppose GraphQL APIs are just more likely to have introspection turned on since it’s the default?
- gofreddygo 4y ago> with almost no changes to my scraper Thats the killer feature.
- marcosdumay 4y agoYes, GraphQL allows you to expose a domain. What is a really big problem, because websites are organized as an hierarchy of resources, applications are organized as a collection of actions, and nobody on the user-facing side ever thinks about a domain of small interrelated things. With nobody thinking about the interface, you are left with the classical dilemma between usability and security. And all GraphQL tooling seems to floor their feet on the usability side.
- twodave 4y agoThanks, this is thought-provoking. I went and did some reading—-am I mistaken for thinking simply disabling introspection in production is a hard counter to this? I realize for a public API (or API product) that isn’t super helpful, but for my own use cases nobody on production needs it. Other than that, it seems that the answer is just performing object-level authorization to ensure you never leak resources a user isn’t supposed to have access to. Depending on the framework you use this can be pretty straightforward…
- marcosdumay 4y agoYes, if your data is not entirely public, you will need object-level autorization. But the point is that no, it's not straightforward; the authorization must be designed to fit your needs. If you are not designing it, you can be certain that it's broken.
- twodave 4y agoThanks for taking the time to explain. You’ve helped me revise my opinion (yes, some folks are willing to receive new information and change haha).