{"id":81087,"date":"2018-08-27T09:11:35","date_gmt":"2018-08-27T06:11:35","guid":{"rendered":"http:\/\/www.javacodegeeks.com\/?p=81087"},"modified":"2018-09-06T09:26:37","modified_gmt":"2018-09-06T06:26:37","slug":"build-a-secure-api-with-spring-boot-and-graphql","status":"publish","type":"post","link":"https:\/\/www.javacodegeeks.com\/2018\/08\/build-a-secure-api-with-spring-boot-and-graphql.html","title":{"rendered":"Build a Secure API with Spring Boot and GraphQL"},"content":{"rendered":"

\u201cI love writing authentication and authorization code.\u201d ~ No Java Developer Ever.<\/b> Tired of building the same login screens over and over? Try the Okta API for hosted authentication, authorization, and multi-factor auth.<\/a><\/span><\/p>\n

GraphQL is a data query language developed by Facebook in 2012 to solve a shortcoming of REST APIs and traditional database models. All too often, when programmers write REST API data queries, they default to retrieving entire data structures when they need only a part of it. For example, if you want to find out the number of comments on a blog post, a developer might typically retrieve the entire post and all associated fields along with all the comments and all their associated fields only to<\/strong> count the number of comments in the resulting array.<\/p>\n

This is pretty inefficient. However, modern computers are fast. Even a shared server these days is pretty damn fast, as long as you have hundreds or thousands of users. However, when you get to Facebook scale, reaching a sizeable portion of the human beings on the internet, this breaks down. This kind of inefficiency becomes either unworkable or expensive.<\/p>\n

It is possible, of course, to write a better SQL query (or NoSQL query) and write a specific API front end call to count the number of blog posts that is far more efficient – but you have to do this for every specific data query case.<\/p>\n

There\u2019s also the problem of wanting more data. What if you want a set of users blog posts and their associated comments AND you also want another set of unrelated data? Typically you make two separate calls to the REST API. In fact, a REST API interaction can result in dozens of calls over the course of a specific API interaction as all necessary data is retrieved. Again, on modern broadband and with relatively few users, this is functional. With hundreds of millions or even billions of users, it breaks down. Milliseconds of efficiency matter. Reducing the number of network calls matters.<\/p>\n

There has to be a better way, a more generalized way to allow a front end to request only the data it wants, and to reduce the number of network interactions by combining requests for data.<\/p>\n

This is why Facebook developed GraphQL. It provides a framework to describe your data model and allow consumers of the data to ask for exactly what they want and to retrieve predictable results.<\/p>\n

When Would I Use GraphQL?<\/h2>\n

GraphQL is enormously powerful and flexible, and when used at internet scale, can provide a significant performance improvement over traditional REST APIs. So why wouldn\u2019t<\/strong> you use it? Well, in my experience, on smaller projects, I felt like I was often just moving a lot of REST logic into GraphQL schema definitions, where validation and authorization code ended up being nested into a fairly ugly gigantic schema. I also felt like I was duplicating my data type definitions: once in GraphQL and another time in my ORM (this may not be a problem with all implementations).<\/p>\n

GraphQL also brings a unique set of security concerns – there\u2019s nothing wrong with it; it\u2019s just going to be different than using REST APIs or SQL queries so you need to spend a little time researching security. I would consider using it in a situation where an application was going to scale quickly or where the data set might evolve significantly over time. If I had a limited set of well defined data on a smaller project, I\u2019d probably just stick with a REST API.<\/p>\n

How Do I Use GraphQL?<\/h2>\n

From a developer perspective, there are two major components:<\/p>\n