<instructions>Your goal is to analyze the following comment and estimate how highly it will be upvoted by the Hacker News community.</instructions><comment><author>brunoc</author><text>I feel that by using these types of tools you could really miss out on a fantastic opportunity to create a schema that models the business domain as accurately and elegantly as you want to make it, regardless of the underlying service topology or the databases behind it.&lt;p&gt;That&amp;#x27;s what I find the most attractive about GraphQL. Large companies and companies that have grown fast often have all kinds of APIs made at different time by different people with different standards. GraphQL lets you paper over that without breaking existing, revenue making code.</text><parent_chain></parent_chain></comment><story><title>GraphQLize: JVM library to build GraphQL API instantly from PostgreSQL and MySQL</title><url>https://www.graphqlize.org/blog/announcing-graphqlize-alpha</url></story>
<instructions>Your goal is to analyze the following comment and estimate how highly it will be upvoted by the Hacker News community.</instructions><comment><author>mooted1</author><text>For the love of god, this is never how GraphQL was intended to be used. The official graphql website is very clear:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;graphql.org&amp;#x2F;learn&amp;#x2F;authorization&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;graphql.org&amp;#x2F;learn&amp;#x2F;authorization&amp;#x2F;&lt;/a&gt;&lt;p&gt;&amp;gt; Delegate authorization logic to the business logic layer&lt;p&gt;If you take security or performance debugging seriously, you should never expose database models through APIs directly in a production app.&lt;p&gt;To illustrate, say you have an Employee model:&lt;p&gt;&lt;pre&gt;&lt;code&gt;  query {
      employee(userId=uuid) {
          name
          salary
      }
  }
&lt;/code&gt;&lt;/pre&gt;
Say you add some hacks on top of this to only allow users to query their own employee data, believing this provides adequate security.&lt;p&gt;The next day, someone creates a Manager object, a relation from employee to Manager, and Manager to employee.&lt;p&gt;Now, without having consider security for a second, you&amp;#x27;ve granted all employees the ability to query each other:&lt;p&gt;&lt;pre&gt;&lt;code&gt;  query {
      employee(userId=uuid) {
          name
          salary
          manager {
              employees {
                  name
                  salary
              }
          }
      }
  }
&lt;/code&gt;&lt;/pre&gt;
To say that these problems occur in the wild frequently is an understatement. Since these graphql frameworks also expose introspection capabilities, discovering these exploits can be automated using crawlers. If you write a bug like this, and you will, people will find it.&lt;p&gt;Please, please stop encouraging people to directly expose their databases through an API.</text><parent_chain></parent_chain></comment><story><title>GraphQLize: JVM library to build GraphQL API instantly from PostgreSQL and MySQL</title><url>https://www.graphqlize.org/blog/announcing-graphqlize-alpha</url></story>