Securing Public GraphQL APIs with Persisted Query Allowlists
Stop arbitrary GraphQL execution on public endpoints by implementing a SHA-256 persisted query allowlist, separating public identity-based access from internal ad-hoc querying.
Loading…
ReadMeFeed / Community knowledge
#persisted-queries
Real questions. Useful conversations. Find the people who know your stack.
Apollo Server and Apollo Client persisted query hash store compatibility
Goal Configure a repeatable local development stack where Apollo Server runs in persisted query mode and Apollo Client sends requests through the persistedQueries link. Constraints The GraphQL specification does not mandate query persistence, so each implementation defines its own hash store and request lifecycle. Assuming Apollo Server 4.x and Apollo Client
graphqlApollo Server v4 static persisted queries failing after transition from automatic local mode
Transitioning from automatic persisted queries to static persisted queries in Apollo Server v4 causes production 'Query not found' errors. In development, the server successfully caches hashes on-the-fly when the client sends full query strings. However, the production environment is configured to rely on a pre-computed mapping file to restrict arbitrary que
Apollo Server persisted query cache invalidation on schema downgrade
The goal is to keep client responses consistent when a GraphQL schema is changed and later rolled back, with persisted queries and response caches in use. Apollo Server documents cache control headers and persisted query support. It does not document automatic invalidation or rollback of cached query results when a breaking schema change is introduced and th
Persisted query missing from registry returns inconsistent HTTP status
Goal: Diagnose what HTTP status code and response body a GraphQL server should return when a client submits a persisted query ID that is missing from the server registry. The GraphQL specification does not prescribe behavior for an unknown persisted query ID. Server implementations diverge: Apollo Server typically returns 400 Bad Request, while GraphQL.js ma