Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GraphQLize: JVM library to build GraphQL API instantly from PostgreSQL and MySQL

graphqlize.org

Post reply on HN
Print view View original

11–20 of 61 posts

Re: GraphQLize: JVM library to build GraphQL API instantly from PostgreSQL and MySQL

#11

Post by holtalanm »

rattray wrote: post #9
mooted1 wrote: post #7

For the love of god, this is never how GraphQL was intended to be used. The official graphql website is very clear: https://graphql.org/learn/authorization/ > Delegate authorization logic to the business logic layer If you take security or performance debugging seriously, you should never expose database models through APIs directly in a production app. To illustrate, say you have an Employee model: query { employee(…

The solution to this should be to use the db's security/permissions model. For example, with postgres: https://stackoverflow.com/questions/49261452/combining-row-l...

i was thinking this, too. http://postgrest.org/en/v6.0/ comes to mind. Its security is based on postgres user permissions.

Re: GraphQLize: JVM library to build GraphQL API instantly from PostgreSQL and MySQL

#12

Post by paulryanrogers »

holtalanm wrote: post #11
rattray wrote: post #9

Earlier quoted context omitted.

The solution to this should be to use the db's security/permissions model. For example, with postgres: https://stackoverflow.com/questions/49261452/combining-row-l...

i was thinking this, too. http://postgrest.org/en/v6.0/ comes to mind. Its security is based on postgres user permissions.

Separate DB user per application user makes connection pooling difficult. And PostgreSQL has more costly connections

Re: GraphQLize: JVM library to build GraphQL API instantly from PostgreSQL and MySQL

#13

Post by aidos »

dvasdekis wrote: post #10
mooted1 wrote: post #7

For the love of god, this is never how GraphQL was intended to be used. The official graphql website is very clear: https://graphql.org/learn/authorization/ > Delegate authorization logic to the business logic layer If you take security or performance debugging seriously, you should never expose database models through APIs directly in a production app. To illustrate, say you have an Employee model: query { employee(…

I agree that this is indeed a problem, but your proposed cure is unnecessarily onerous. At least with Hasura's equivalent product, allowing queries on related objects is an opt-in process for the admin, after each related object is defined. I think a better piece of advice is: Please stop allowing people to query relational models automatically, and surface a separate locked-down schema for the GraphQL user. These Gr…

Hasura gets this very right.

Re: GraphQLize: JVM library to build GraphQL API instantly from PostgreSQL and MySQL

#15

Post by aidos »

paulryanrogers wrote: post #12
holtalanm wrote: post #11

Earlier quoted context omitted.

i was thinking this, too. http://postgrest.org/en/v6.0/ comes to mind. Its security is based on postgres user permissions.

Separate DB user per application user makes connection pooling difficult. And PostgreSQL has more costly connections

Hasura avoids this issue by having it’s own row level security model. In fact they go one step further in that for any subscriptions, they can run one query for all connected clients by building a temp table with a row per client using their session variables to join against. (They poll for subscription updates since it’s fast and scales well)

Re: GraphQLize: JVM library to build GraphQL API instantly from PostgreSQL and MySQL

#16

Post by tflinton »

paulryanrogers wrote: post #12
holtalanm wrote: post #11

Earlier quoted context omitted.

i was thinking this, too. http://postgrest.org/en/v6.0/ comes to mind. Its security is based on postgres user permissions.

Separate DB user per application user makes connection pooling difficult. And PostgreSQL has more costly connections

Pgbouncer

Re: GraphQLize: JVM library to build GraphQL API instantly from PostgreSQL and MySQL

#18

Post by MikeAmelung »

meritt wrote: post #6

I understand this stuff is "cool" but this is only one step removed from db->query(input[sql]). I'm not talking about SQL injection either, I'm talking about wholesale data exfiltration of your entire database because you've auto-generated some slick GraphQL API and you don't take the time to think through what should, and should not, be exposed to end users or bother to implement any form of access control.

Not only that, it only lets you query your "root" type by primary key? So it's less functional than the normal interface to the database. I'm having a really hard time understanding the point of this.

Re: GraphQLize: JVM library to build GraphQL API instantly from PostgreSQL and MySQL

#20

Post by Fellshard »

siquick wrote: post #19

Been playing around with GraphQL in the last day or so and just can't see any reason to use it over REST (or REST + an ORM). Am I missing something? Is it just so people don't have to learn SQL?

Client-side shaping of queried data without directly writing SQL against a back-end database, and without having to pre-arrange queried data structure with the back-end.
Post reply on HN