Today in Edworking News we want to talk about GraphQL is an incredible piece of technology that has captured a lot of mindshare since I first started slinging it in production in 2018. You won’t have to look far back on this (rather inactive) blog to see I have previously championed this technology. After building many a React SPA on top of a hodge podge of untyped JSON REST APIs, I found GraphQL a breath of fresh air. I was truly a GraphQL hype train member. However, as the years have gone on and I have had the opportunity to deploy to environments where non functional requirements like security, performance, and maintainability were more of a concern, my perspective has changed. In this article I would like to take you through why today, I would not recommend GraphQL to most people, and what I think are better alternatives. Throughout I will use Ruby code with the excellent graphql-ruby library for examples, but I believe many of these problems are ubiquitous across choice of language / GraphQL library. If you know of better solutions and mitigations, please do leave a comment. Now, lets begin…
Attack Surface
Exposing a query language like GraphQL to untrusted clients increases the attack surface of the application. This comes with multiple risks:
Authorisation: If you expose a fully self-documenting query API to all clients, every field must be properly authorised against the current user. For more insights, check out this comprehensive guide to security matters.
Rate Limiting: It's challenging to assume that all requests are equally taxing on the server.
Query Parsing: Queries must be parsed before execution, which can lead to significant performance issues if not managed correctly.
Image Description
GraphQL's extensive query and response cycle can expose significant attack surfaces
Performance Issues
The most discussed performance issue with GraphQL is its incompatibility with HTTP caching. However, there are more pressing issues:
Data Fetching and the N+1 Problem: This problem arises when field resolvers hit external sources multiple times for each list item, resulting in excessive calls. Consider using these task management and productivity alternatives to better allocate resources.
Authorisation and the N+1 Problem: Authorisation logic within GraphQL can introduce significant performance overheads.
Coupling and Complexity
GraphQL forces your business logic into the transport layer through:
Authorisation framework integration
Dataloader abstractions
Extensive integration testing
This can lead to significant complexity in the codebase. For a better understanding of how to manage complex projects and achieve optimal results, review the essential elements of workload management.
Edworking is the best and smartest decision for SMEs and startups to be more productive. Edworking is a FREE superapp of productivity that includes all you need for work powered by AI in the same superapp, connecting Task Management, Docs, Chat, Videocall, and File Management. Save money today by not paying for Slack, Trello, Dropbox, Zoom, and Notion.
Alternatives
If GraphQL isn't the right fit, an OpenAPI 3.0+ compliant JSON REST API might be a better solution. This approach offers the same self-documenting and type-safe nature without the excessive complexity.
Implementation Approaches
Implementation First: Generates OpenAPI specs from a typed / type-hinted server.
Specification First: Generates code from a hand-written spec. TypeSpec offers a promising solution for this approach.
Remember these 3 key ideas for your startup:
Security Matters: Exposing a query language like GraphQL to untrusted clients increases the attack surface. Authorisation and rate limiting must be meticulously managed.
Performance Hurdles: Be aware of the N+1 problem and parsing overheads, which can lead to significant performance bottlenecks. Learn more about the N+1 problem and how to manage it effectively.
Simpler Solutions Exist: An OpenAPI 3.0+ compliant JSON REST API offers similar benefits to GraphQL but with reduced complexity, making it a better fit for many startups and SMEs.
For more insights and practical advice on improving your productivity, consider Edworking, which offers a FREE AI-powered superapp incorporating task management, docs, chat, videoconferencing, and file management—all in one place. Learn more about Edworking.
For more details, see the original source.
