@@ -97,28 +97,34 @@ MD5 hash of the GraphQL document, as traditionally used by Relay.
9797
9898## Persisting a Document
9999
100- A client utilizing persisted documents MUST generate a _ document identifier_ for
101- each GraphQL Document it wishes to issue to the server, and SHOULD ensure that
102- the server can retrieve this GraphQL Document given the document identifier.
103-
104- Note: The method through which the client and server achieve this is
105- implementation specific. Typically persisted documents are stored into some kind
106- of trusted shared key-value store at client build time (either directly, or
107- indirectly via an authenticated request to the server) such that the server may
108- retrieve them given the identifier at request time. It is generally good
109- practice for the client to issue both the GraphQL Document and the document
110- identifier to the server; the server should then regenerate the document
111- identifier from the GraphQL Document independently, and check that the
112- identifiers match before storing the Document. An alternative approach has the
113- client issue the GraphQL Document to the server, and the server returns an
114- arbitrary _ custom document identifier_ that the client should incorporate into
115- its bundle.
116-
117- When using persisted documents as an operation allowlist, the client MUST
118- persist the documents it uses ahead of time in a secure manner (preventing
119- untrusted third parties from adding their own persisted document) such that the
120- server will be able to retrieve the identified document within a _ persisted
121- document request_ and know that it is trusted.
100+ A client that wishes to utilize persisted documents for a request must generate
101+ a _ document identifier_ for the associated GraphQL Document and should ensure
102+ the server can retrieve this GraphQL Document from the document identifier. The
103+ method through which the client and server achieve this is implementation
104+ specific.
105+
106+ Note: When used as an operation allowlist, persisted documents are typically
107+ stored into some kind of trusted shared key-value store at client build time
108+ (either directly, or indirectly via an authenticated request to the server) such
109+ that the server may retrieve them given the identifier at request time. This
110+ must be done in a secure manner (preventing untrusted third parties from adding
111+ their own persisted document) such that the server will be able to retrieve the
112+ identified document within a _ persisted document request_ and know that it is
113+ trusted.
114+
115+ Note: When used solely as a bandwidth optimization, an error-based mechanism
116+ might be used wherein the client assumes that the document has already been
117+ persisted, but if the request fails due to unknown _ document identifier_ the
118+ client issues a follow-up request containing the full GraphQL Document to be
119+ persisted.
120+
121+ Note: When persisting a document it is generally good practice for the client to
122+ issue both the GraphQL Document and the document identifier to the server; the
123+ server would then regenerate the document identifier from the GraphQL Document
124+ independently, and check that the identifiers match before storing the Document.
125+ An alternative but equally valid approach has the client issue the GraphQL
126+ Document to the server, and the server returns an arbitrary _ custom document
127+ identifier_ that the client would incorporate into its bundle.
122128
123129## Persisted Document Request
124130
0 commit comments