GraphQL Is for Client Developers Not Client Applications
summary
Argues that GraphQL’s power becomes a liability when untrusted clients can send arbitrary queries and that restricting clients to predefined operations drastically reduces attack surface. Firebase Data Connect turns selected GraphQL documents into Connectors — bundled, persisted queries and mutations exposed as an RPC-like endpoint backed by Postgres — generating client SDKs that are not GraphQL-aware. Uses server expressions and operation-level auth with off directives so trusted servers keep full query power while untrusted clients can only use vetted operations, enabling static complexity analysis and safer CI.
AI-written summary · about
chapters (7)
- 0:00Context and motivation
- 1:28The curses of GraphQL
- 4:26Analyzing the security gap
- 10:37Query-defined infrastructure
- 13:21Firebase data connect demo
- 20:25Shift to query-centric model
- 23:34Benefits and conclusion
related talks
01h 00mGraphQL - A query language to empower your API consumers
31mGraphQL: how to make clients enjoy using your API
43mGraphQL in the Era of Server Components
30mWhy GraphQL vs. Why not GraphQL
58mGraphQL -- Flexible APIs for Adaptive Clients
31mGraphQL Without GraphQL: Backend Agnostic Requests with GraphQL Style Querying
40mGraphQL: Designing a Data Language
48mGraphQL Is the New Sexy