Fairly easy to get around and continue without loc...
# general
d
Fairly easy to get around and continue without local caching but it led me to do a bit of reading on [disabling] graph introspection which seems to be up for some debate. I'm wondering why you chose to disable it.
r
Thanks for the feedback @dabombace ! We actually chose to disable it for security purposes. Our most recent pen-test suggested that the graphQL introspection queries might pose an unnecessary risk related to enumerating fields and allowing for DOS attempts
d
Interesting for sure. I would interpret that as a pretty strong repudiation of graphql in general then.
r
I wouldn't necessarily say that - I think there are just different tools for different jobs. It really depends on your call patterns. Graphql can be useful with FHIR when you have a number of Resources that are linked to each other
For example: This repo has our basic "hello world" example (https://github.com/medplum/medplum-hello-world). The "patient details" page uses GrapQL to fetch Service Requests and DiagnosticReports related to a patient: https://github.com/medplum/medplum-hello-world/blob/main/src/pages/PatientPage.tsx
But the home page uses the REST search API to get a list of all the patients in a project (https://github.com/medplum/medplum-hello-world/blob/main/src/pages/HomePage.tsx#L25)
I think it depends on the use case. We totally agree that disabling the introspection queries can be frustrating when setting up tooling, but we wanted to opt on the side of security until we could find a better alternative
d
Thanks for the info. I'm gonna keep trucking along w my flutter app and messing around with the graph apis no local cache for now.
c
@dabombace We statically pre-generate the schema. It is available here: https://graphiql.medplum.com/schema/schema-v1.json
I also have mixed feelings about graphql, so I understand the hesitation. There are certainly instances where it is great though. Happy to discuss more if you're interested
(warning: schema file is ~40mb, which is kind of ridiculous, but it is FHIR-graphql-spec compliant)
d
Yea, having it disabled thus not having clients requesting the type info probably means better performance and scaling not withstanding any security concern.
It's a graphql problem not a medplum problem 🙂
We'll be talking about this for the next decade until the next thing.
c
Something totally new will come around right when we solve all of the graphql problems
178 Views