We built the web application first and directly access modules, and use GraphQL to server to iOS so a slightly different scenario.
I would be personally be inclined to talk directly to the module functions and bypass a whole load of overhead of handling the GraphQL call, encoding the response, decoding the response, rebuilding structs for the web application to interact with - it will make coding harder and the system less performant to have all those extra, unnecessary layers in there.
Could you elaborate on your worries about session management, cookies, caching etc that you think using GraphQL will solve for?
