Apollo GraphQL Blog

blog.apollographql.com · Company blog · on HN since 2018

Apollo's engineering team writes about GraphQL tooling, including Apollo Server and Client, federation, security, and company funding news.

What HN saysHN links it in GraphQL discussions; commenters cite its posts on securing APIs against malicious queries and persisted queries.
21HN people shared it
9linked it in comments
19stories submitted
457story points
7 years agolast shared
2018people per year2026

Most-shared posts

  1. 1
  2. 2
    Goodbye, Slack. Hello, Spectrum
    3 people · 73 points · first shared 2019 · 70 comments on HN
  3. 3
    Securing Your GraphQL API from Malicious Queries
    2 people · 4 points · first shared 2019 · discussion on HN
  4. 4
    Announcing Apollo Server 2
    2 people · 4 points · first shared 2018 · discussion on HN
  5. 5
  6. 6
    Introducing the Apollo GraphQL Platform
    1 people · 145 points · first shared 2018 · 11 comments on HN
  7. 7
    Apollo raises $22M to simplify app development
    1 people · 113 points · first shared 2019 · 73 comments on HN
  8. 8
    Apollo Client 2.5 for GraphQL Announced
    1 people · 73 points · first shared 2019 · 20 comments on HN
  9. 9
    First Impressions with Apollo Client 3
    1 people · 6 points · first shared 2020 · 1 comments on HN
  10. 10
  11. 11
    Schema Change Notifications with Apollo Graph Manager
    1 people · 6 points · first shared 2020 · discussion on HN
  12. 12
  13. 13
    Apollo Client Releases Official Support for React Hooks
    1 people · 3 points · first shared 2019 · discussion on HN
  14. 14
    Using Apollo Link to Handle Dependent Queries
    1 people · 3 points · first shared 2020 · discussion on HN
  15. 15
    Apollo Client [React]– How to Query on Click
    1 people · 2 points · first shared 2020 · discussion on HN

What HN people wrote when they linked it

therealtbs · 2019-07-19
I have been using GraphQL professionally as a frontend developer for about 1.5 years and I think it is definitely getting more relevant now. I can't speak for many services that use GraphQL since we always have our own backend that we use. But I can speak a bit from my experiences using it with a number of different backends. So first up: The number one thing GraphQL does really well is the tooling. You can have anywhere from a full-featured client for your SPA with Apollo [0] to a simple client for just one-off requests like urql[1]. You can have your schema be automatically turned into type definitions for TypeScript so everything is strictly typed from the backend to the frontend. Do you want to adopt microservices? You can offer your frontend-devs a single GraphQL-endpoint with schema stitching or Apollo Federation[2]. Also great is the ability to compose queries how you see fit. Need a sub-sub-sub entity of whatever you're querying? If the schema is properly set up, that is easily done in one request, while with REST you are potentially looking at up to 4 requests that need to be made. So from a UX-perspective it is also quite nice because there may be lower latency. Since GraphQL is different from REST, it does require a different way of thinking by the backend developer. I've worked on one project where the developers weren't quite thinking in GraphQL, so they had fields that referred to objects by their ID instead of referring to it directly. That coupled with…
lewisl9029 · 2019-06-20
It's definitely not for everyone (or every kind of community), but I've had reasonable success with it in a mostly-remote workplace where voice channels can help emulate desk-to-desk interactions with your immediate team, but as a purely opt-in process compared to a real open-office where you open yourself up to disruptions by anyone at any given moment all the time, and have no opt-out mechanism outside of leaving your desk and camping in a conference room. Not sure what sort of community you're launching, but if it's for coding definitely check out Spectrum. The Apollo team made a great post about their search for a new community platform and landed on Spectrum due to a couple of reasons that might apply to you as well: https://blog.apollographql.com/goodbye-slack-hello-spectrum-8fa6b97964… TL;DR: The product itself is open source, it has a mechanism for longer-form discourse like traditional forums as well as real-time chat, and is fully index-able by search engines. Wish you the best on your launch!
sixhobbits · 2019-10-24
I see more and more people moving to Slack communities for the QA that they used to post on SO. This is sad - slack is a closed protocol and is not searchable. Answers are only available to a subset of the tech community and only for a limited time (no one really searches before asking the same question again but someone will usually prompt with "that got asked a couple of days ago" in cases of extreme duplication.) Spectrum [0] is heading in the right direction to counter this but it's still a walled garden. [0] https://blog.apollographql.com/goodbye-slack-hello-spectrum-8fa6b97964…
laredoj · 2019-02-07
Others have been looking at this problem and the possibilities of bringing down your backend with a mischievous request... https://blog.apollographql.com/securing-your-graphql-api-from-maliciou… reminds us of `select * from <big table>
vga805 · 2018-11-30
1. can be addressed with persisted queries. Apollo has this option: https://blog.apollographql.com/persisted-graphql-queries-with-apollo-c… and Relay Modern has a PR open for it. Doing something similar without one of these graphql client libraries shouldn't be too tough.
tylerhou · 2018-08-24
If you know your queries at compile time, then you can register each query with the server when you build as the hash of the query. Then clients only have to send up the hash and the server can look them up in its registry; plus you now have an easy way to cache (cache based on query hash plus user). If it's the first time you've seen a query, you can hash it and add it to the registry as well. See: https://github.com/apollographql/apollo-link-persisted-queries https://blog.apollographql.com/improve-graphql-performance-with-automa…
andrewingram · 2018-11-29
Right, this is the approach I've always advocated. I don't mention it specifically in this post I wrote a while ago about optimising GraphQL, but my implicit assumption was that you're building your GraphQL server on top of an underlying platform: https://blog.apollographql.com/optimizing-your-graphql-request-waterfa… In real-world UIs, I've found that queries rarely end up being more than a few levels deep and are relatively easily optimised as long as your internal APIs can handle batches (easy for entities, harder for pagination). Additionally, even though the only-return-IDs-for-relations pattern means you can't utilise joins effectively, the upside is that you end up with much simpler database queries that area easier to optimise at scale. My rule of thumb was that as long as the query representing an entire screen could typically return in sub 100ms in production, it was acceptable (this was without any caching at the GraphQL level, which I had planned but left the company before I could implement it).
schrockn · 2018-07-19
Nick Schrock here, one of the GraphQL co-creators. I agree with a lot of the criticism in terms of the difficulty of implementing GraphQL backends. I think there's a big opportunity for folks to build vertically integrated toolkits that deal with N+1 issues, integrate DataLoader natively and so forth. Good versions of these would deal with a lot of issues described here in greenfield GraphQL backends. I talked about this at the GraphQL Europe keynote last month (https://www.youtube.com/watch?v=zMa8rfXI6MM). Current greenfield implements are typically stacked on ORMs like Django and RoR, and the impedance mismatch is real. Personally I abide by the dictum that ORMS are "Vietnam of computer programming" and should be avoided at all costs for anything that will grow beyond a small app. GraphQL was not originally implemented on top of an ORM, but instead an object model built on key-value + edge store internal to Facebook. In terms of other criticisms in this thread: 1) Exceptions: The default behavior in graphql-js (mimicked in other language implementations) of swallowing native exceptions by default was probably a mistake in hindsight. Whenever I've played with GraphQL using different toolsets the first thing I change is to add a wrapper function which checks for errors and then rethrows the initial exception that caused the GraphQL error for use in testing and CI/CD contexts. 2. Caching: Personally I've always been confused about the concern with leveraging HTTP-level…
sgk284 · 2018-07-19
Eh... I'm torn on it and could write at length about this, but here's my off-the-cuff thoughts. For context, my co-founder and I are quite active in the GraphQL community. If you've ever used apollo-cache-persist[1] or graphql-crunch[2], we authored those libraries. Our startup, if you're curious, is a social podcasting app written in react-native (https://banter.fm). We learned a lot of GraphQL lessons building it. The tl;dr; is that graphql gives you a lot of flexibility and typed schemas are nice, but it doesn't come for free and I miss the tooling around http. Pros: - Typed schema - Custom queries retrieve all the data the client needs in one request - Really easy to implement, both server-side and client-side - Server-side, it's trivial to have any field resolved in any way you want (redis, memcache, postgres, some random service) - Easy and arbitrary mutations. There's no pontificating over what verbs are the proper ones to us. - If you use react, the community and ecosystem often assumes you're using GraphQL, so it may make sense to use graphql just so you don't swim against the current. Cons: - The payloads can quickly become huge because there is often a ton of duplication in a responses (depending on your query patterns). See this example on the SWAPI demo: https://bit.ly/2uOFZBP. The result is 1MB of JSON, ~97% of which is data that exists somewhere else in the response already. - Refactoring types is often impossible to do in a backwards-compatible…

Keyboard shortcuts

/Search
j kNext / previous blog
EnterOpen selected blog
vVisit the blog site
fFollow / unfollow
lSwitch grid / list view
dSwitch dark mode
g hHome
g pTop posts
g tTopics
g fFollowing
g lLiked
g yHistory
g qFAQ
EscBack / close