GraphQL can be challenging, and not only for beginners. The reason for this is often that it's so tempting to do the wrong thing. In this session, I will walk you through the various challenges of building production-ready applications with GraphQL. We will discuss the differences between a public GraphQL server and a private GraphQL server. I will show the most common mistakes people encounter with GraphQL and how to tackle them.

In this talk, we will look at persisted operations, rate-limiting, introspection security, the right defaults for paging, errors, and many more aspects. This talk is suitable for you whether you are a GraphQL server or client implementer or just a user of GraphQL. After this session, you should have a solid understanding of how to put GraphQL into production in a secure way.

GraphQL is celebrating ever-increasing success in the API zeitgeist: a flexible language for describing precise, consumer-defined queries to data sources in a language capable of describing complex relationships between entities of any shape we can imagine. However, to a developer coming from the world of OData, it may seem quite limited at first: how do I filter my data or build complex aggregations? How do I avoid race conditions when I start changing it?

In this talk, we'll look at the OData specification, and discuss a number of its ideas that (I think) would be worth adopting into the culture of GraphQL. We'll look at the differences between the two ecosystems, the open source projects that try to reconcile those differences, and probably end up inventing a third competing standard along the way.

We will have a look at common ways enterprises use GraphQL, what common software design principles are used in enterprises, and how these pattern and principles can help us improve our GraphQL APIs.