Tag
graphql
Published articles tagged graphql.
Authentication and authorization in GraphQL
GraphQL needs identity in context and authorization at field granularity. This chapter covers transport auth, resolver and field guards, NestJS GqlExecutionContext, node(id) IDOR risks, and subscription connection_init.
Building a GraphQL server with NestJS
NestJS can expose a code-first GraphQL API with the Apollo driver, auto- generated SDL, decorators for types and resolvers, validation pipes, request- scoped DataLoaders, and graphql-ws subscriptions. This runbook walks from install to a working endpoint.
Evolving a GraphQL schema
GraphQL favors continuous schema evolution over versioned URLs. This chapter classifies safe and breaking changes, documents @deprecated fields and enum values, outlines a deprecation workflow, and shows deprecationReason in NestJS code-first schemas.
Getting started with urql
urql 5 wires React apps to GraphQL through a client, exchanges, and hooks. This chapter shows createClient with cacheExchange and fetchExchange, auth headers, request policies, mutations, document-cache invalidation, and subscription exchanges.
GraphQL clients compared
Browsers and React apps can talk to GraphQL with fetch, thin wrappers, urql, Apollo Client, Relay, or TanStack Query. This comparison covers what each layer adds—caching, codegen, normalized stores—and when to pick one.
GraphQL federation
Federation lets independent teams publish subgraphs that compose into one supergraph queried through a router. This overview explains composition, entities and @key, migration directives, major platforms, a NestJS subgraph sketch, and when federation is worth the operational cost.
GraphQL glossary
Terms used across the GraphQL series—from schema and SDL through resolvers, urql exchanges, deprecation, persisted queries, and federation—each defined briefly and linked to the chapter that goes deeper.
Input types and arguments
Arguments tune individual fields; input object types bundle structured write payloads. GraphQL keeps input and output types separate, which shapes how you design mutations, validate data, and avoid breaking clients when forms evolve.
Limiting query depth and cost
Depth limits, complexity analysis, alias caps, timeouts, persisted query allowlists, and disabling introspection protect GraphQL from expensive operations. This chapter shows NestJS complexity plugins and gateway-level controls.
Managing GraphQL schemas in organizations
Large companies rarely expose one undifferentiated graph. This overview covers public, partner, and internal APIs, schema registries and contracts, CI checks against real operations, ownership, and versioning strategies from continuous evolution to dated releases.
Normalized caching with urql Graphcache
Graphcache stores records and links like a client-side database, enabling mutation updates, optimistic UI, schema-aware keys, and offline replay. This chapter configures @urql/exchange-graphcache for urql 5.
Object types and scalars
Object types model entities with fields; scalars are the leaves that hold concrete values. This chapter covers built-in and custom scalars, enums, lists and non-null markers, interfaces, unions, and the __typename field clients use for polymorphism.
Pitfalls when updating a GraphQL backend
Schema changes that look safe on paper still break mobile clients, caches, and federation. This troubleshooting guide lists common symptoms, root causes, and fixes—from nullability shifts to persisted queries and deploy order.
Resolvers and execution
Resolvers connect schema fields to data sources. This chapter explains the four resolver arguments, default resolvers, parallel query execution, per- request context, the N+1 problem, DataLoader, and how errors bubble through nullable fields.
Schema design in GraphQL
Good GraphQL schemas mirror how clients use data, not how tables are joined. This chapter covers query-driven design, naming and nullability, Relay-style connections, mutation payloads, and modeling errors as typed results versus the top-level errors array.
Schemas and SDL
A GraphQL schema is the contract between client and server: types, fields, and root operations written in Schema Definition Language or generated from code. This chapter explains SDL syntax, the Query/Mutation/Subscription roots, schema-first versus code-first workflows, and introspection.
Securing GraphQL APIs
A single /graphql endpoint concentrates power and risk. This overview maps GraphQL-specific threats—introspection, deep queries, alias abuse, CSRF, and verbose errors—to controls you should layer at the gateway and in resolvers.
Typed operations with GraphQL Codegen
GraphQL Codegen client-preset generates typed document nodes and React hooks from .graphql files and your schema. This runbook configures codegen.ts, the graphql() helper, fragment masking, watch mode, and optional persisted operation hashes.
What is GraphQL
GraphQL is a typed query language for APIs: clients describe the shape of the data they need, and the server returns JSON that matches. This overview covers how requests flow from parse to execution, how responses differ from REST, and when a GraphQL layer is worth the complexity.
Writing GraphQL operations
Operations are the queries, mutations, and subscriptions clients send. This chapter covers operation names, variables, aliases, reusable fragments, inline fragments for unions, and @include/@skip—patterns you will use in urql and codegen-backed apps.