February 2018 Summaries

The talk videos cover various aspects of GraphQL development and deployment, including real-world usage stories from companies like Coursera and Samsara. Jon Wong shares strategies for layering GraphQL on top of REST APIs, while Sashko Stubailo presents a solution for deploying stateless GraphQL APIs using AWS Lambda and Apollo Engine. John Haytko explores client-side caching with Apollo Link, and Christopher Biscardi discusses the use of the GraphQL SDL to decouple client and server implementations. Stephen Wan talks about the benefits of end-to-end type systems, using tools like Thunder and apollo-codegen to automate development processes. The meetup aims to share knowledge and best practices for using GraphQL in production environments.

This summary highlights the importance of securing a GraphQL API from malicious queries. The article discusses how GraphQL's flexibility can be both an advantage and a security risk, as it allows for complex and nested queries that can overload servers and databases. To mitigate this, three main protection methods are presented: Size Limiting, Query Whitelisting, and Depth Limiting. While these methods have trade-offs, they provide a good starting point for securing a GraphQL API. Additionally, the article introduces Query Cost Analysis as an advanced method that can provide full coverage against malicious actors, but requires more work to implement. The recommended approach is to use Depth and Amount Limiting as the minimum protection, with Query Cost Analysis being considered for more complex scenarios.

The newly announced `apollo-boost` is an easy-to-use booster kit for Apollo Client that aims to simplify GraphQL state management. It provides a zero-config solution, allowing developers to get started with Apollo Client quickly and easily. The new client setup is designed to be simple and intuitive, making it ideal for beginners. With `apollo-boost`, developers can focus on building powerful applications without getting bogged down in complex configuration settings. The tool also includes some essential packages that are recommended for building an Apollo app, such as `apollo-link-error` and `apollo-link-state`. Additionally, the release of `apollo-boost` marks a return to the original goal of simplicity, which was deviated from with the introduction of Apollo Client 2.0's modular architecture. The tool is designed to be easy to learn and use, making it an exciting development for the GraphQL ecosystem.

The Apollo Client Devtools have been improved with a new architecture that addresses stability and performance issues, including fixes for slow responses and broken queries. The dark mode has also been enhanced, and GraphQL subscriptions are now fully supported in GraphiQL. Additionally, client-side schema support has been added, allowing developers to query local state data and view the schema for their local state. The Devtools will no longer support Apollo Client 1.0, but an old version is available for manual installation. Future updates include official support for more browsers, sophisticated schema exploration, and time traveling debugging.