express-graphql VS graphql-shield

It looked a little janky but it actually worked fine. But then I needed file uploads. Something graphql-zeus does not support. So I had to create a small wrapper for the SDK created so that it worked. And then also express-graphql, the server I was using, was deprecated.

This seems like a minor deal unless you're not using Express as your web framework. And an important note here is that Express GraphQL is being deprecated by the GraphQL Foundation. So if you're using Express for a GraphQL API, you should move away from it anyway.

You might have seen other GraphQL server solutions where the schema is implemented by using a more programmatic approach. Here is an example of how schemas are implemented using the express-graphql library. (link: https://github.com/graphql/express-graphql)

I'm not sure where the "8MB limit" comes from but, indeed, there are issues like this where, in some implementations, the response size is limited to 100KB: https://github.com/graphql/express-graphql/issues/346

With Node I used express-graphql as opposed to something like Apollo because it's lighter and less heavy on resources compared to Apollo.

Daniel Rearden listed the following reasons pushing him to create Helix, believing that these factors were absent from popular solutions like Apollo Server, express-graphql and Mercurius:

Express GraphQL is a library for building production ready GraphQL HTTP middleware. Despite the emphasis on Express in the repo name, you can create a GraphQL HTTP server with any HTTP web framework that supports connect styled middleware. This includes Connect itself, Express and Restify.

If you are using Node.js there are a lot of implementations of GraphQL servers with a few being express-graphql, apollo-server, mercurius, graphql-helix and more. And if you are using other languages, you can see a great list here

express-graphql GitHub Repository

Not sure about other libraries but it's certainly not the case for express-graphql on node.js. You can tie the graphql endpoint to any method you like. On the site I work on, we have a graphql endpoint that only accepts GET requests in production and is thus cacheable by Cloudfront. In dev and staging we accept all requests so that GraphIQL works.

- https://github.com/dimatill/graphql-shield/issues/988 - https://github.com/dimatill/graphql-shield/issues/1485

Second a NextJS app is deployed to Vercel containing a GraphQL server function. This is an Apollo server that consumes the halo-graphql package using GraphQL Modules. The server also implements caching and rate limiting using GraphQL Shield.

GraphQL Shield is a great tool for creating authorization layers that has vast adoption from the community. In fact, GraphQL AuthZ is highly inspired by GraphQL Shield! However, GraphQL Shield uses a different approach compared to GraphQL AuthZ for applying authorization rules.

Haven't used it yet but GraphQL Shield looks pretty good. https://github.com/maticzav/graphql-shield

You can also use libraries like GraphQL Shield which offers powerful middlewares to do this. But remember that authorization does come with attached cost since you are running a specific logic in/before your resolvers for all the fields which you want to authorize.

Try graphql-shield