Designing Secure GraphQL APIs : Not a Paradigm Shift but Handling Complexity
summary
GraphQL orchestration at Intuit secures a QuickBooks supergraph that spans 80 third-party APIs used by 17,000 third-party apps producing ~250,000 transactions/day. Authentication runs at the router with JWTs, upstream identity validated by mutual TLS or shared keys, and sensitive scopes minimized. Authorization delegates to an authorization decision service (PDP) called from resolvers for fine‑grained policy enforcement. Rate limits combine router/gateway throttles with business‑logic limits (example: email send rate limiting to stop spam), enforced end‑to‑end.
AI-written summary · about
chapters (6)
- 0:00Introduction and Intuit context
- 2:10API security challenges overview
- 8:51Authentication patterns in GraphQL
- 17:09Authorization patterns and delegation
- 22:51Rate limiting strategies
- 24:37Key takeaways and conclusion
related talks
51mAPI Security: Securing GraphQL without going around in circles
19mThe “Food Court Menu” of APIs: A GraphQL Introduction
20mAdvanced GraphQL Security with AI-Driven Threat Detection
37mIs your GraphQL API safe? Let’s find out
32mMind your GraphQL APIs: how to reduce their attack surface
39mDon't Panic: A Developer's Guide to Building Secure GraphQL APIs
30mTechniques to Protect Your GraphQL API
10mEvolution of Application Networking Patterns with GraphQL