I now see people on HN have very similar complaints about GraphQL - how its power and flexibility makes making a performant and secure GraphQL backend significantly harder than making an oldschool REST API backend.
We ended up regex-parsing the OData query fragments that our app happened to use and made it work. We felt dirty for months after, though.
Does anyone have experience with both? Is GraphQL any better than OData in server-side implementability?