> The biggest issue that we see is security, as we outline this in The API Churn/Security Trade-off[1] essay. > Apparently facebook uses a whitelist to deal wi

> The biggest issue that we see is security, as we outline this in The API Churn/Security Trade-off[1] essay. > Apparently facebook uses a whitelist to deal with the security issues introduced by GraphQL, but many developers who are using GraphQL appear to not understand the security threats involved with it. I link to a longer essay on the inherent issues w/ increasing the client-side expressiveness of an API. It boils down to the fact that you give that power to anyone who can fire up a web console, in contrast with server-side expressiveness. [1] - https://intercoolerjs.org/2016/02/17/api-churn-vs-security.html https://intercoolerjs.org/2016/02/17/api-churn-vs-security.h...