Hacker News new | ask | show | jobs
by holtalanm 1875 days ago
This. Your resolvers should still do access control. No different than a REST api would.