4 ms·
This reminds me of my main concern with GraphQL, namely that I could never find a good example showing how you weave security within a request. The examples I s
by gonyea 10y ago
This reminds me of my main concern with GraphQL, namely that I could never find a good example showing how you weave security within a request. The examples I saw made me feel uncomfortable. Like, the client requests progressed further than I felt they should.
My typical approach to securing REST APIs is to use guard clauses + white lists. This is very explicit and easy to comprehend.
- akeating 10y agoThe option to look for, irrespective of language of implementation, is "context". An example of usage may be found in https://github.com/graphql/express-graphql https://github.com/graphql/express-graphql. Basically the context (session or user data) is passed into any resolve function you define, so you may relate operations to permissions using some mechanism you define. Edit: grammar
- brokentone 10y agoWell, similar to REST, security is not in the spec, but in the implementation. Different than REST, comes introspection. You would have to advertise fields and mutations to some people that you wouldn't to others, which is a bit of an odd paradigm with how you might do this at scale, but it's not fundamentally different than REST, just looks / feels different. I haven't seen many people write on the subject for Graph -- in our implementation on Vogue.com, we don't have need of multiple auths. All the fields we describe are "public" and we don't support mutations at this point.
- deleted 10y ago[deleted]