Add notes from July WG (#301)

Author: benjie

working-group/notes/2024/2024-07.md

@@ -0,0 +1,51 @@
+# GraphQL-over-HTTP WG - 25th January 2024
+
+**Watch the replay**:
+https://www.youtube.com/watch?v=nHSixplvCc0&list=PLP1igyLx8foEz9127xc0SsabIrbTMt9g5
+
+Agenda:
+[https://github.com/graphql/graphql-over-http/blob/main/working-group/agendas/2024//07-Jul//25-graphql-over-http-wg-july-2024.md](https://github.com/graphql/graphql-over-http/blob/main/working-group/agendas/2024//07-Jul//25-graphql-over-http-wg-july-2024.md)
+
+- Action item: Talking to Apollo about persisted operations
+  - Jovi: Biggest issue were the set identifiers
+  - Jovi: They were also keen on moving away from extensions
+- Persisted operations identifier syntax (Martin)
+  - Martin: Persisted documents, commented on the PR from Benjie for a formal
+    syntax for the operation identifiers
+  - Martin: follow-up PR
+    [https://github.com/graphql/graphql-over-http/pull/296](https://github.com/graphql/graphql-over-http/pull/296)
+  - Martin: Big question, should we restrict the characters to alphanumeric,...?
+  - Martin: started with allowing everything, after a comment from Benjie
+    restricted it more.
+  - Martin: It’s always easier to relax rather than restrict the syntax
+  - Martin: currently it’s restrictive allowing for URL-safe base64, checksums
+    and guid
+  - Martin: Does anyone need something else that is not captured in the PR?
+  - Shane: Why forego an existing spec, i.e. using a smiley face in wikipedia
+    encodes well as well
+  - Benjie: as Martin said, it’s easier to relax than restrict - if there’s no
+    solid use case for enabling additional characters we shouldn’t do so.
+  - Benjie: the only missing one is allowing additional colons
+  - Benjie: point to the RFC as copied it, non-normative
+  - Benjie: I am in favor of this proposal
+- Persisted operations
+  - Benjie: A change to /graphql/<hash>/<operation-name>
+  - Benjie: traditional tooling can understand the format more
+  - Benjie: the sub-path solution would solve a lot of the common grievances
+    with GraphQL like easier debugging,...
+  - Jovi: we would need to highlight how to handle variables when i.e. URL gets
+    too long
+  - David: we have to ensure that clients that don’t go out of spec
+  - David: I don’t love the concept of documentId in the JSON body
+- Advancing the spec
+  - Benjie: base spec excluding persisted operations is basically done and what
+    everyone does anyway
+  - Benjie: we should address security concerns, we have to be sensible as we
+    don’t want to repeat the whole HTTP spec
+  - Jovi: looking at prior art like gRPC they mention building on the HTTP/TLS
+    spec
+  - Shane: Things to explicitly note, Nature of GET vs POST and CORS
+  - Samuel: being strict about content-type/…
+  - Benjie: Good point, by saying that they _may_ use other encodings is
+    stopping ourselves from using them in the future. Worth passing by Dennis
+  - Benjie: There are a few encodings that I have used that aren’t in the spec