Re:GraphQL Is a Trap?
by jseban on Friday May 06, 2022 @02:15PM
(#31288231)
In my mind that's just an insert that joins the contracts table and makes a case active_contracts < 3 then true else false, for the require_sign_off column.
[ Parent
| on HN ]
Re:GraphQL Is a Trap?
by littlecranky67 on Friday May 06, 2022 @02:57PM
(#31288596)
You cannot trust the query issuer (Browser or App on the client). If you have a public GraphQL API, you need to enforce these rules. If you can just alter the query to bypass the business rule, this is called a security hole.