Know who is making a GraphQL request and control exactly which data and operations they can access.
Authentication determines who the user is, while authorization determines what that user is allowed to access. In GraphQL, authentication information is commonly added to the request context so resolvers can use it when processing operations.
Authorization can become more complicated in GraphQL because a single query may request many different fields and nested resources. Access checks may therefore need to happen at the field, resolver, or business-logic level rather than simply protecting one URL.
What you'll walk away knowing