GraphQL

App name, model seal, model name, model name, model version, version, content type, application, JSON, lookup.

The verify tab queries the Arweave GraphQL endpoint, Arweave.

Net, GraphQL, by these tags to find manifests, newest first, the end fetches the JSON from Arweave.

Net and compares hashes in the browser.

Why no server? Every step a server adds is another thing to trust and another thing that can go down.

Reading a whole multi-gigabyte file into one buffer is the fastest way to crash a tab, so chunked, incremental hashing is not optional.

Tag design is the index.

With good Arweave tags, manifests can be found through GraphQL without running any index server of my own.

And to be quite honest, I still enjoy trying to try to remediate this kind of stuff, try to understand what's going on.

For this particular incident, one of the main things we saw was a particular uptick in GraphQL requests.

They were trying to forge some of these requests to try to look legitimate.

But with our malware rules and with our web application firewalls, we were able to quickly identify these requests were malicious.

You can sometimes upload different, I don't know, files to the web server.

And when you try to execute them, some of the times they fail, some of the times they work.

But most of the stuff we see around the style smuggler was to try to exploit the GraphQL endpoint.

and then try to host a file and then try to execute a web shell.

So if you ever need to find and access an entity, then you're literally just doing the search in DynamoDB and then pulling in an S3 file where the entire entity exists.

Now, we use GraphQL instead of a RESTful API.

And the reason for that is that these entities can get pretty big.

if you've got an entity which has got a thousand records in it you know that could be a lot of a lot of edges there you don't necessarily need to see an individual person's an individual's name a thousand times or their address a thousand times you want to be able to summarize that data on the API so that's one reason that we use a GraphQL API because for every individual query you can change the change exactly what you're asking for you can do some kind of analytics on the actual um API but the result is that we kind of solve the graph scaling problem so whenever you query an entity from us and you will on the the kind of the cloud version you will always get the entire entity back in a consistent time doesn't matter if it's one record or um 100 000 records in in the um And the entity, once you've found it, then it's just a kind of a timeline to transfer that across the network to your computer.

We do still run into some pretty big entity clusters sometimes.

So humans, like natural persons is not so difficult to do the entity resolution on because a person is a person, right? They don't get super complicated.

I know who, you know, you know who you are.

Um, and, but I've been telling them for a long time, Hey, uh, you are relying on GraphQL persistent queries or persistent queries as a, uh, you know, authorization mechanism.

And you cannot do that.

Like that is not how that's supposed to work, you know? And that is a defense in depth mechanism because I go to their dev site and I find, you know, where that it doesn't have those queries, those predefined queries.

And guess what, guys? That day came the other day.

And my AI, you know, it like noticed that a new header got like pushed into a JS file.

And that header was like something that allowed me to bypass layers in the GraphQL validation.

And then I using if that header was set to a value.

What's everybody been up to?

Yeah, Jovi de Kroek has been working on GraphQL LSP, which is a TS server plugin that can give you diagnostics autocomplete and hover inside of your GraphQL calls using the content mappers, which are the brand new... hotness everyone's doing cool stuff with content mappers apparently in the 7.1 beta so this is pretty cool same idea do you do you want to do you want to get completions on the thing that's not typescript in typescript let's do it yes super cool and one of the perennial petas has been like getting graphql like type completion and now you can get it just through the content mapper API instead of doing like the tag template syntax with some hairy type inference based on the string like writing your own

compiler.

Now you can use straight up the content mapper that loads the schema and validates all of the documents against it.

35.

How to build a GraphQL data layer for REST Microservices GraphQL is a great technology for REST Microservices.

Learn how to create a data layer for microservices without writing any code.

36.

So I'm sure people remember, just as Matt and me, what happens when there are a lot of different standards.

Because we work with GraphQL, we work with RESTful, we work with...

What was this format that they use XML from ASP.NET? SOAP.

Like

Cap what a single request can askfor without the clamp is a single request that passes every rate limit and still exhausts memory.

The same applies to batch endpoints, GraphQL query depth, and file uploads.

Each needs its own maximum.

Cap how long work canrun timeouts turn a slow endpoint from an outage into an error.