Re:PostGraphQL: PostgreSQL meets GraphQL
by jordanthoms on Monday December 12, 2016 @11:22PM
(#13164415)
The amount of code needed to verify that only the proper fields and records are included for a particular response taking into account the user's permissions etc is often not so different from the code needed to retrieve just that data in the first place.
There is an issue here where as you give more sophisticated querying capabilities to the client, you need to have correspondingly more sophisticated validation of those queries on the server, which offsets some of the gain.
Perhaps another way of asking it: how is GraphQL different to sending SQL statements from the client? In both scenarios you'd be "only" handling validation logic and ignoring the rest.
Re:PostGraphQL: PostgreSQL meets GraphQL
by tscs37 on Tuesday December 13, 2016 @07:46AM
(#13166372)
Not much difference except that GraphQL does not specify how the data is processed.
You could answer the data out of a flatfile for all that the endpoint cares.
It also allows to secure access against arbitrary data requests, since on the server end, the resources only see the individual requests to the DB.
In my experience, it's much easier and less verbose to validate GraphQL after parsing than just validating any SQL you plan to pass to the backend.
Why would you need to write the same amount of code? The only code that would remain the same is the validation logic.