Well, the gist of the op article is kind of "they can't prevent you from using their internal API", so most services shouldn't try. I think there's still a difference between making people scan your entire frontend code/traffic to find all the edge cases and making them reverse engineer your auth/headers/cookies (hours of work) vs handing them database access after 2 minutes of work. But I appreciate it, and it might be engineers that know this (that preventing access is futile) leaving it on intentionally. I certainly have done that.
Re:How to use undocumented web APIs
by slaymaker1907 on Thursday March 10, 2022 @08:52PM
(#30635199)
So it's not only security through obscurity, it's very weak obscurity.
Security through the obscurity of a wedding veil.
Not only is it translucent, but your audience tends to have a better idea than they can directly see at the moment as to what it's hiding.
If you really intend for your GraphQL API to be used only internally and from your official web client, and you consider any fields not currently requested in your web client to be highly sensitive, you should really turn off public access to the full GraphQL API and use something like GraphQL's persisted queries where your web client requests queries by an opaque unique identifier rather than the fully text of the query.