GraphQL : The new REST?
Tags: bugbounty, security, apisecurity, blst
Published: 2022-03-31 15:46:50

GraphQL was created in 2012 by Facebook as a way to make it easier for developers to fetch the data they need from the Facebook API. GraphQL provides a complete and understandable description of the data in your API, gives clients the power to ask for exactly what they need and nothing more, makes it easier to evolve APIs over time, and enables powerful developer tools.

## What Is really GraphQL?
GraphQL is a query language for APIs and a runtime for fulfilling those queries with your existing data. GraphQL provides a complete and understandable description of the data in your API, gives clients the power to ask for exactly what they need and nothing more, makes it easier to evolve APIs over time, and enables powerful developer tools.

## What makes GraphQl different from REST?

![credit: nordicapis.com](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/s604hdkcygkz3fmifa3a.png)


1. GraphQL is a query language for your API, not just a data format. This means that you can query for exactly what you need, and get back clean, easy-to-use data.
2.  is type-safe. This means that you can be sure that the data you're getting back from your API is the data you expect, and that it's valid.
3.  is self-documenting. When you query the GraphQL API, you also get back documentation for the fields and types that are available.
4.  is backed by a single endpoint. This means that you don't need to worry about maintaining multiple endpoints for different data types, or versions of your API.
5.  is extensible. You can add your own types and fields to the GraphQL schema, and query them just like any other data.

In other words, the old REST model is like ordering pizza from multiple shops, each with their own phone number. This can be time-consuming and frustrating, especially if you change your mind about the toppings halfway through. With GraphQL, it's like ordering a pizza from one shop. You tell them what toppings you want, and they'll get you the pizza with the toppings you want. If you change your mind, you can just ask for different toppings. No need to start from scratch.

## The Basics in three words
- It lets the client specify exactly what data it needs.
- It makes it easier to aggregate data from multiple sources.
- It uses a type system to describe data.

## More technical terms..

Three main compements:
**Schema**, **queries** and **resolver**.

## Queries..
A query is the request the client makes. Query fields can point to arrays and support arguments.
A typical querie in Qraphql look likes this.
` 
query{
  object {
     table
   }
}
`

## Resolver
Resolvers are responsible for fetching the data for a specific field. Without a resolver, the GraphQL server would not know what to do with the data corresponding to a field. By decoupling the API schema and the database schema, GraphQL allows you to use the former to modify the contents of the latter.

`Query: {  post(root, args) {    return Posts.find({ id: args.id });  }}`

Resolver can also be used to modify data in which case they’re known as mutation resolvers.
`mutation {
  createUser (userName:"user1") {
    userName
  }
}`

## Schema
A schema is a blueprint for a GraphQL API. It defines the types of data that can be fetched from the API, and how that data can be mutate.


GraphQL is not as popular as REST, but it is very efficient  and it is growing in popularity. GraphQL is a good choice for modern development and it is worth learning.
I will publish next week a new article about API security and graphQL.
See you next week :)