<story><title>SQL is a better API language than GraphQL – Convince me otherwise</title><url>https://twitter.com/simonw/status/1250803209871847426</url></story><parent_chain><item><author>meritt</author><text>I feel like this thread is tongue-in-cheek to make people realize that &amp;quot;run any query on the client side&amp;quot; is a terrible idea, and that&amp;#x27;s exactly what most GraphQL installations offer.&lt;p&gt;As a penetration tester though I like GraphQL, it&amp;#x27;s a very handy data exfiltration engine. By default, there&amp;#x27;s no authorization, no authentication, and it even comes with introspection. One query and I get your entire schema! This trendy movement will be far worse for data security than SQL injection, unsecured S3 buckets, or misconfigured NoSQL instances.</text></item></parent_chain><comment><author>throw_m239339</author><text>&amp;gt; As a penetration tester though I like GraphQL, it&amp;#x27;s a very handy data exfiltration engine. By default, there&amp;#x27;s no authorization, no authentication, and it even comes with introspection. One query and I get your entire schema! This trendy movement will be far worse for data security than SQL injection, unsecured S3 buckets, or misconfigured NoSQL instances.&lt;p&gt;All of that has nothing to do with GraphQL though, it&amp;#x27;s just poor security. You&amp;#x27;d have the exact same issue with classic REST, SOAP, or whatever protocol one is using. I imagine the issue is that people are using &amp;quot;convenience&amp;quot; frameworks on top of their GraphQL libraries that do the glue between their databases and GraphQL and these frameworks don&amp;#x27;t have security as a priority.&lt;p&gt;Development-wise I&amp;#x27;d argue that the less endpoints, the more secure, but it doesn&amp;#x27;t mean an app should have the exact same GraphQL endpoint for both its admin and its user facing data.&lt;p&gt;The principle of the least privilege will always apply along with a rigorous security audit, code audit and third party lib audit.</text></comment>
<story><title>SQL is a better API language than GraphQL – Convince me otherwise</title><url>https://twitter.com/simonw/status/1250803209871847426</url></story><parent_chain><item><author>meritt</author><text>I feel like this thread is tongue-in-cheek to make people realize that &amp;quot;run any query on the client side&amp;quot; is a terrible idea, and that&amp;#x27;s exactly what most GraphQL installations offer.&lt;p&gt;As a penetration tester though I like GraphQL, it&amp;#x27;s a very handy data exfiltration engine. By default, there&amp;#x27;s no authorization, no authentication, and it even comes with introspection. One query and I get your entire schema! This trendy movement will be far worse for data security than SQL injection, unsecured S3 buckets, or misconfigured NoSQL instances.</text></item></parent_chain><comment><author>karatestomp</author><text>Yeah my first encounter with GraphQL was a client going &amp;quot;let&amp;#x27;s save development time by using graphql!&amp;quot; so I looked into it and it&amp;#x27;s &lt;i&gt;more fucking work&lt;/i&gt; unless your stack has one of those auto-GraphQL-to-and-from-DB generators (they&amp;#x27;d made a poor and somewhat obscure choice of DB for the project, over our advice, so there wasn&amp;#x27;t such a thing in this case anyway) and it happens to suit your needs very well—and even with the benefit of one of those I&amp;#x27;d &lt;i&gt;still&lt;/i&gt; lose sleep over security or DoS bugs lurking in that 3rd party code. Or in mine.</text></comment>