Hacker News Reader

> I think the only reasonable way to use GraphQL is to only allow a set of whitelisted queries

That's already how it works, it is not an open ended SQL query. The GraphQL schema is the whitelist.

No, I mean of whitelist of full GraphQL queries with string/number arguments, where you can only run one of the queries in the whitelist, and the client can only choose which query and the string/number values, but not submit an arbitrary query string.

The schema you expose can do that afaik.

Reply on news.ycombinator.com