After 6 years, I'm over GraphQL (bessey.dev)

Article summary

The article discusses the author's experience with GraphQL over the past six years and why they no longer recommend it due to its complexity, security concerns, and performance issues. The author highlights problems such as increased attack surface, authorization, rate limiting, and data fetching, which can lead to significant complexity and maintenance costs. The article also explores alternatives, including OpenAPI and REST APIs, which may be more suitable for certain use cases. The author concludes that GraphQL may not be the best choice for most people, especially those with limited resources or simpler requirements.

Main themes

• GraphQL limitations
• Security concerns
• Performance issues
• Alternatives to GraphQL
• Complexity and maintenance
• API design

What commenters say

• GraphQL is well-suited for large-scale applications with complex access control and authorization requirements, but may be overkill for smaller projects.
• The complexity of GraphQL is a significant drawback, and its benefits may not outweigh the added cost and maintenance requirements for many use cases.
• GraphQL's flexibility and self-documenting nature are major advantages, but its security and performance issues need to be carefully considered.
• Exposing database queries directly to clients is a security risk, and additional layers of abstraction and access control are necessary to prevent vulnerabilities.
• REST APIs and OpenAPI may be more suitable alternatives to GraphQL for certain use cases, offering simpler and more maintainable solutions.
• The idea that GraphQL is only suitable for monolithic applications with shared access patterns is disputed, and some commenters argue that it can be effective in microservices architectures with proper implementation.
• The use of GraphQL does not necessarily imply a 1:1 mapping with the database, and intermediate application code is often necessary to implement the API layer.