Trusted Documents (also known as persisted operations) allow RedwoodJS to enforce that the GraphQL server only executes pre-approved queries and mutations. Instead of sending the full GraphQL document over the network, the client sends a unique hash ID. The server then looks up this ID in a pre-generated store to execute the corresponding query.
This approach provides several benefits:
- Security: Massively decreases the attack surface by preventing malicious actors from executing arbitrary GraphQL queries, which helps prevent unwanted resolver traversal or information leaking.
- Performance: Increases performance and decreases bandwidth usage by reducing the size of request payloads.
This feature is ideal for GraphQL APIs that serve only your own application.