One concern I have with Graphql is security and access to data.
I'm sure there are plenty of ways to control it, but I'd wager that most will be ignored outside of basic ACL’s.
Often times certain user types should only have access to certain fields in data or be able to query it in certain ways.
Too often I see apps where the developers just assume they have full control since they're making the interface, while it's trivial to watch the API calls and intercept or modify them.
I'm sure there are plenty of ways to control it, but I'd wager that most will be ignored outside of basic ACL’s.
Often times certain user types should only have access to certain fields in data or be able to query it in certain ways.
Too often I see apps where the developers just assume they have full control since they're making the interface, while it's trivial to watch the API calls and intercept or modify them.