The Daily
A note a day on APIs and the realities of shipping web applications. Stuff I've actually learned across 25 years of doing the work.
GraphQL Introspection in Production Is a Gift to Attackers
Leaving GraphQL introspection enabled in production hands your entire API schema to anyone with curl. I've seen this in the wild and it's worse than you think.
Introspection is one of GraphQL's best developer experience features and one of the most consistently mishandled security decisions I see in production APIs. Leaving it on is the equivalent of publishing your entire database schema on your homepage — every type, every field, every relationship, every mutation, fully…
Read the daily →Postgres Replication Lag Burned Me: Read-After-Write Is Harder Than It Looks
I shipped a feature that worked perfectly in dev and fell apart in production. The culprit was replication lag I didn't account for.
I deployed a feature for a healthcare client that let patients update their contact information and immediately see a confirmation screen reflecting those changes. It worked flawlessly in every environment I tested. It broke in production within the first hour. The bug took me an embarrassing amount of time to track…
Read the daily →PostGraphile: When the Magic Stops Being Magic
PostGraphile auto-generates a GraphQL API from your Postgres schema in minutes. Then you need a plugin, and the clock stops.
PostGraphile's zero-config GraphQL generation is genuinely impressive. Point it at a Postgres schema and you get queries, mutations, subscriptions, and pagination — all wired up and typed correctly. I've demoed it to clients and watched their eyes light up. Then I needed to customize something real, reached for the…
Read the daily →PostGraphile: The Versioning Problem Nobody Warns You About
PostGraphile's magic is that your GraphQL schema lives in your database. That's also why versioning it will eventually bite you.
PostGraphile will generate a production-quality GraphQL API from your Postgres schema in about fifteen minutes. I've done it more than once and the first hour always feels like cheating. The part that feels less like cheating — and more like a trap you walked into with your eyes open — is what happens six months later…
Read the daily →Why I Stopped Reaching for Stored Procedures in App-Driven Code
Stored procedures sound like good engineering until you've debugged one at 11pm with no stack trace. Here's why I keep my logic in the app layer now.
I used to think stored procedures were a sign of seriousness. Mature engineering. The kind of thing you did when you actually cared about your database. Then I spent two days tracking down a bug in a procedure that had quietly broken a billing calculation for a print management client, and nobody noticed for six weeks…
Read the daily →