826 karma · joined October 19, 2010
1. Wrap the entire query execution in an auth check. This is similar to whatever happens in a REST auth flow. Check the caller is legit before moving on. Nothing graphQL specific here.
2. Check auth on fields. This is a neat thing about graphQL. You can statically analyze the fields in the query to make sure the caller is only accessing fields they are supposed to. We do this by adding an `auth` property to the standard graphQL-js field object. When we build the schema we do some fanciness to wrap the resolvers in a new function that checks that field and behaves accordingly[1]
3. Throw errors on unauthorized data. Same as you would in a REST API. If you get back data the caller can't access, check it before replying. Obviously not ideal, but sometimes this is the only option.
At someone on twitter's request I wrote up some more thoughts a while back about running graphQL in production: https://gist.github.com/southpolesteve/08edb6a481c07f66eb71e...
I also gave a talk on this at Node Interactive last week: https://youtu.be/vI9ERvz9WWU
[1] https://gist.github.com/southpolesteve/e190e9572d060b5158366...
Of course I am just one anecdote. They could be doing amazing.
{ "statusCode": 200, headers: {}, body: "<h1>Hello!</h1>" }
And API Gateway knows exactly what to do. Before this, yes there was some extra config and it was not fun.
PS. Our AWS bill went down when we moved everything to Lambda but that was not the motivating factor for the switch
It is most definitely ready. I gave a talk at Node Interactive last year that has some more detail https://www.youtube.com/watch?v=c4rvh_Iq6LE&index=2&list=PLf...
APIs are contracts. As a method of expressing those contracts, REST just doesn't have enough vocabulary and it is too simple. You have to make too many decisions on your own. That is where the "ful" comes from in RESTful :) Plenty of effort has been put into fixing this, but those tools never really received enough traction. They also fail to solve all the problems outlined in a single cohesive way. JSON-API is maybe the closest thing that currently exits.
Contrast that with GraphQL's explicit typed vocabulary. A more rigid and explicit language for API contracts. It is a godsend for writing complex APIs. Everything works out of the box. The developer friendliness also is fantastic (GraphiQL is the killer app). GraphQL places a high priority on developer and consumer UX which is something that previous iterations like SOAP and WSDL were lacking.
TLDR: GraphQL makes building complex JSON APIs easy. Sure you might not need it. But you probably want it.
That said, we use node. I have heard cold starts are worse for Python (I have no data). I have heard they are near unbearable for Java (JVM startup and all that). We try and minimize external calls outside the main handler. Previous to this update we were packing configs with webpack at deploy time. Some people read them from S3 or dynamo. I don't consider that a good solution. I'll be working this week on Shep 3.0 which will use the new ENV var features.
I have talked to other people who do various hacks to force their functions to be warm. I've looked at doing this and haven't found it necessary yet for our use case.
[1] www.bustle.com and www.romper.com do a combined XX million unique visitors per month.
Edit: An example of the kind of thing I am concerned will happen[2]. Use the word "serverless" in a project? Get a take down notice.
[1]http://tmsearch.uspto.gov/bin/showfield?f=doc&state=4802:t7t...
[2]https://twitter.com/sindresorhus/status/776142274564616192
I have one hard example I can share. We had a node service that was running on ec2 and cost ~$2500/mo. Moved the code directly over to lambda. Now ~$400/mo.
Quantifying other costs is a bit harder but do you have a DevOps person on your team? Or multiple people? How much do they get paid?
But my personal experience says Lambda is ready for prime time. We use it in production. ~15 million API calls per day. Mostly user facing HTTP requests. Even with the rough edges I would prefer to use it for any new web development project. It feels like at least an order of magnitude reduction in risk/complexity of scaling and deploying code. Its not "zero" but that is huge for me and for my team. We spend more time shipping.
[1]We wrote one: https://github.com/bustlelabs/shep but there are plenty of others mentioned in the comments.