How to implement authentication and authorisation in GraphQL?

Q: How to implement authentication and authorisation in GraphQL?

Difficulty: 8/10

Field-level Authorization, GraphQL Context, Federated Security

GraphQL execution should begin after authentication middleware confirms the user’s identity and passes that information to the GraphQL layer. But after that, you still need to determine if the authenticated user is allowed to view the data provided by the specific fields that were included in the request.

It’s simple to use any Express middleware in conjunction with graphql-http. In a REST API, authentication is often handled with a header, that contains an auth token which proves what user is making this request. Express middleware processes these headers and puts authentication data on the Express request object. Some middleware modules that handle authentication like this are Passport, express-jwt, and express-session. Each of these modules works with graphql-http.

Scenario Questions

0-2 years experience

1Imagine you're building a blogging platform where users can only edit their own posts. How would you pass the user's session token from an HTTP header down to a specific GraphQL resolver to verify their identity before saving?
2We have a query that returns a list of users, but only admins should see the 'email' field. If a regular user queries the list, how would you handle hiding just that specific field while still returning the rest of the user data?

2-5 years experience

Follow-up Questions

How do you handle nullable fields in your schema design when an authorization check fails?
If you use custom schema directives for auth, how do you unit test those rules without spinning up a full server?
How does your authorization strategy change when dealing with real-time subscriptions over WebSockets?