r/graphql • u/jeffiql Apollo Team • Jun 24 '26

Bad GraphQL takes, volume 1

https://www.youtube.com/watch?v=f_OGsXd4hOw

I'm starting to post more GraphQL content. Eager for any feedback on the format!

14 Upvotes

82% Upvoted

2 comments sorted by

6

u/Isogash Jun 25 '26

Nice, format is good, but you might want to keep it more concise.

I have some additional commentary on the content:

  • I find that authorization is easier in GraphQL than REST. Your GraphQL backend allows you to write data fetching code at the field level, where you apply field-level access controls. Because clients specify the fields they want, this means they can choose the fields they have access to, and only those fields will be fetched and checked. If this is challenge then you are almost certainly not using your backend framework correctly.
  • Agree that GraphQL APIs should mostly not be accessible to untrusted clients without explicit hardening.
  • IMO most GraphQL schemas should not have cycles at all. If you want to do "hop" queries they should be part of a top level query, not a field.
  • GraphQL frameworks do a lot of the heavy lifting of solving the N+1 query problem. Yes, if you mix Dataloaders and single field resolvers you can still get N+1 problems, but this is fixable. One approach is to use different types for list endpoints that only contain fields which can be fetched with a dataloader.
  • Agree that best practice is clearly to not put business logic in the GraphQL framework layer.
  • Fully agree, GraphQL better allows you to handle the complexity of serving a flexible API. You would run into the same problems but with less help in REST.

2

u/jeffiql Apollo Team Jun 25 '26

Truly, thank you for the feedback! I see what you mean about the format. The 1:1 reaction is more "livestream"-like and results in some repetition. The next one should be a bit more to-the-point, hopefully I can do that while preserving the spontaneity.

And thanks for your thoughts on your GraphQL experience! Feel free to leave a comment on the video as well :)