Security

A bookstore can correctly authenticate every caller and still become unavailable when one permitted operation requests thousands of related records. It can also protect a customer's orders through one resolver while accidentally exposing them through another path.

GraphQL security requires control over both data access and the work an operation can cause.

This chapter develops those controls around a bookstore API, including request admission, trusted documents, browser behavior, and long-lived connections.