Prisma

hi guys i have simple question - i was thinking what if someone got my graphql mutations , is my app is safe or he/she can do bad things to my app by using those mutations ?

also if i am doing authentications and checking every time on each mutation that this is the right person to give access

As long as you have the appropriate **authentication** (user has identified themself) and **authorization** (verify that the user can perform each action) in place then you shouldn't have an issue.

that's great , and what do you think is the prefect time to expire the token ? i have implemented the authorization with JWT and when ever i login i get the new token but the old token is also available and i can do things with that.