4 ms·

Did GraphQL fix the authorization problems? Locking resources and attributes to authorised users?

• alexanderson 10y ago
  Using Apollo Server, I get around authentication with an auth query which updates the context object of the query with the auth token of the user. Then, any subsequent queries can use that auth token to authenticate the user and authorize it for the query themselves. I've also seen it where the authentication is handled by middleware before GraphQL even touches the request. I figure those two methods work for about every use case.
• alexanderson 10y ago
  Using Apollo Server, I get around authentication with an auth query which updates the context object of the query with the auth token of the user. Then, any subsequent queries can use that auth token to authenticate the user and authorize it for the crease themselves. I've also seen it where the authentication is handled by middleware before GraphQL even touches the request. I figure those two methods work for about every use case.
• paulddraper 10y ago
  No more than HTTP or SQL fixes these problems on their own.
• karmajunkie 10y ago
  I do auth with a simple Ajax form and make all of my graphql calls take an auth header. Auth is really somewhat orthogonal to graphql. You can do it with graphql or not, up to you.