GraphQL Directives: An Under Utilized Power at your Fingertips
summary
A real incident-response story: a GraphQL server in front of a legacy API receives malicious strings in an ID field, so a sanitized directive is added to argument and input definitions to enforce a regex and stop revealing server internals. Implementation uses Apollo Server and graphql-tools mapSchema to transform field resolvers; it replaces resolver logic to validate inputs and succeeded at removing verbose legacy errors. Also demos a toy spiceLevel directive for output transformation and warns that broad directive scope raises complexity.
AI-written summary · about
chapters (9)
- 0:00Introduction to directives
- 0:32Anatomy of a directive
- 1:47Schema vs query directives
- 4:47Why use directives
- 7:50Common built-in directives
- 9:43A real-world use case
- 13:24Building a custom directive
- 17:45Directives in other languages
- 19:23Caveats and summary
related talks
30mGo Beyond the Spec With Custom Directives
51mAPI Security: Securing GraphQL without going around in circles
01h 11mGraphQL: 'Dangerous' Advice. Why Use GraphQL When There’s REST?
29mDamn GraphQL - Defending and Attacking APIs
33mEvolving GraphQL Schemas
58mGraphQL -- Flexible APIs for Adaptive Clients
23mAn Introduction to GraphQL
30mGraphQL - A different way to API