@@ -97,28 +97,34 @@ MD5 hash of the GraphQL document, as traditionally used by Relay.
97
97
98
98
## Persisting a Document
99
99
100
- A client utilizing persisted documents MUST generate a _ document identifier_ for
101
- each GraphQL Document it wishes to issue to the server, and SHOULD ensure that
102
- the server can retrieve this GraphQL Document given the document identifier.
103
-
104
- Note: The method through which the client and server achieve this is
105
- implementation specific. Typically persisted documents are stored into some kind
106
- of trusted shared key-value store at client build time (either directly, or
107
- indirectly via an authenticated request to the server) such that the server may
108
- retrieve them given the identifier at request time. It is generally good
109
- practice for the client to issue both the GraphQL Document and the document
110
- identifier to the server; the server should then regenerate the document
111
- identifier from the GraphQL Document independently, and check that the
112
- identifiers match before storing the Document. An alternative approach has the
113
- client issue the GraphQL Document to the server, and the server returns an
114
- arbitrary _ custom document identifier_ that the client should incorporate into
115
- its bundle.
116
-
117
- When using persisted documents as an operation allowlist, the client MUST
118
- persist the documents it uses ahead of time in a secure manner (preventing
119
- untrusted third parties from adding their own persisted document) such that the
120
- server will be able to retrieve the identified document within a _ persisted
121
- document request_ and know that it is trusted.
100
+ A client that wishes to utilize persisted documents for a request must generate
101
+ a _ document identifier_ for the associated GraphQL Document and should ensure
102
+ the server can retrieve this GraphQL Document from the document identifier. The
103
+ method through which the client and server achieve this is implementation
104
+ specific.
105
+
106
+ Note: When used as an operation allowlist, persisted documents are typically
107
+ stored into some kind of trusted shared key-value store at client build time
108
+ (either directly, or indirectly via an authenticated request to the server) such
109
+ that the server may retrieve them given the identifier at request time. This
110
+ must be done in a secure manner (preventing untrusted third parties from adding
111
+ their own persisted document) such that the server will be able to retrieve the
112
+ identified document within a _ persisted document request_ and know that it is
113
+ trusted.
114
+
115
+ Note: When used solely as a bandwidth optimization, an error-based mechanism
116
+ might be used wherein the client assumes that the document has already been
117
+ persisted, but if the request fails due to unknown _ document identifier_ the
118
+ client issues a follow-up request containing the full GraphQL Document to be
119
+ persisted.
120
+
121
+ Note: When persisting a document it is generally good practice for the client to
122
+ issue both the GraphQL Document and the document identifier to the server; the
123
+ server would then regenerate the document identifier from the GraphQL Document
124
+ independently, and check that the identifiers match before storing the Document.
125
+ An alternative but equally valid approach has the client issue the GraphQL
126
+ Document to the server, and the server returns an arbitrary _ custom document
127
+ identifier_ that the client would incorporate into its bundle.
122
128
123
129
## Persisted Document Request
124
130
0 commit comments