Intermediate LevelREST APIs & Web Services
How do Automatic Persisted Queries (APQ) optimize bandwidth and secure GraphQL endpoints?
❓ Interview Prompt: Explain Automatic Persisted Queries (APQ), SHA-256 query hashing, reducing request GET byte payload sizes, and restricting GraphQL query execution.
GraphQL POST payloads sending massive multi-line query strings over the wire consume excessive bandwidth and expose public query execution risks:
Automatic Persisted Queries (APQ):
1
Client computes SHA-256 hash of GraphQL query string.
2
Client sends lightweight request passing ONLY the query hash: 'GET /graphql?extensions={"persistedQuery":{"sha256Hash":"a4b2..."}}'.
3
If server cache contains hash, it executes query instantly!
4
Security Benefit: Production servers can be locked to execute ONLY pre-registered persisted query hashes, blocking arbitrary query attacks!
Code Implementation Example
json
{
"extensions": {
"persistedQuery": {
"version": 1,
"sha256Hash": "ecf4edb9030d5db2ee560711c74c0d0c916d386f70ae5d07277e366d3ed1a63f"
}
}
}💡Automatic Persisted Query SHA-256 hash extension payload.
🎯 Interview Key Takeaway
Use Automatic Persisted Queries (APQ) to shrink GraphQL network payloads and block execution of unauthorized dynamic queries.
#GraphQL#Persisted Queries#Security#Intermediate
Back to all REST APIs & Web Services Questions→