How does Facebook "subscribe" to their GraphQL queries so that everything in the UI updates in realtime?
React and Relay are used to do this.
GraphQL: A data query language
81–84 of 84 posts
Re: GraphQL: A data query language
#82How do GraphQL implementations avoid denial of service? In other words, what stops anyone from easily disabling a website by making a few parallel extremely complex GraphQL requests that consume all CPU and I/O, and perhaps result in holding some locks for a very long time? In normal APIs you can make sure most endpoints are cheap to run, and throttle, secure or otherwise control the ones that must be expensive, but…
FB's GraphQL APIs are only used by our first-party applications; for third-party APIs (where you don't control the callers), it definitely gets trickier for the reasons you note. One option would be to do some analysis of the query in advance (effectively, assign each field a "cost"), and reject queries that have too high of a cost. The "cost" metric could basically be "around how many objects will this return", so i…
This is a concern even for first-party apps, as you are not secure from a malevolant client. Or hell, your own client could have bugs which create some insanely expensive queries on, say, 1% of your devices - didn't catch it in QA, end up pushing it to millions of device for a nice ddos.
Re: GraphQL: A data query language
#83How do GraphQL implementations avoid denial of service? In other words, what stops anyone from easily disabling a website by making a few parallel extremely complex GraphQL requests that consume all CPU and I/O, and perhaps result in holding some locks for a very long time? In normal APIs you can make sure most endpoints are cheap to run, and throttle, secure or otherwise control the ones that must be expensive, but…
FB's GraphQL APIs are only used by our first-party applications; for third-party APIs (where you don't control the callers), it definitely gets trickier for the reasons you note. One option would be to do some analysis of the query in advance (effectively, assign each field a "cost"), and reject queries that have too high of a cost. The "cost" metric could basically be "around how many objects will this return", so i…
Surely you know that anyone can access the binary code of your first-party applications (using a jailbroken iPhone and a rooted Android device), decompile it (using jd-gui, the Hex-Rays ARM decompiler, etc.) and arbitrarily use the APIs they expose, right?
Re: GraphQL: A data query language
#84This looks cool but I've grown to really like Cypher. Anyone know if graphql is similarly expressive?
GraphQL is more akin to a REST pattern and has nothing to do with the actual datastore.
True but doesn't facebook use it with a graph db? The convention is to replace REST with something that maps naturally to data stored in graph... sort of a structural match query that expects certain kinds of nodes/relationships (unless you manually map it to a relational or document db).