Please go here for latest post and feel free to comment
[new post] (https://gist.github.com/idibidiart/49a095b6bc528638f34f)
Last active
February 16, 2016 02:21
-
-
Save idibidiart/04e4cf24e5d2c7aba92c to your computer and use it in GitHub Desktop.
GraphQL/Relay
Are there any security implications related to the adoption of GraphQL?
@nhavar I am sure that there are edge cases that have potential security implications. At least you can't do SQL injection :) but I imagine that you'd have to be careful in how you write your query resolvers. Good question.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
@BenGale
I see. that makes a lot of sense. I'm actually just starting out and wanted to make sure I have the whole concept down! Thank you for your feedback :)
Updated:
(after a Twitter chat with @en_JS (Joseph Savona), one of the GraphQL/Relay developers at Facebook)
Any app state that is not sync'd to the db is not something that Relay encompasses right now, but there is an ongoing
discussion (facebook/relay#114) for handling things like form validation where the validation logic resides on the server
and state updates from sources other than the db (e.g. websocket)
These important scenarios will be addressed according to the Relay Roadmap (https://github.com/facebook/relay/wiki/Roadmap):
fields into the cache: #114.