3 ms·

Thanks for this reply! Are things like query depth, width and cost limiting available as parameters to common libraries? On the auth thing, one thing I common

Thanks for this reply! Are things like query depth, width and cost limiting available as parameters to common libraries? On the auth thing, one thing I commonly do with REST is have a general 'is this user authenticated' middleware and then later have a 'permissions' middleware that checks if the user has rights to see/modify the thing they are trying to, but that's at the service level for that particular thing. Would you follow a similar strategy in GraphQL? Generic auth in a middleware for a user, then specific access management auth inside specific resolvers later on?

Ralfp 7y ago
> Are things like query depth, width and cost limiting available as parameters to common libraries? No, they are mostly 3rd party utils. I those exist for Apollo server. > Would you follow a similar strategy in GraphQL? Generic auth in a middleware for a user, then specific access management auth inside specific resolvers later on? Yes. Or I would move auth check up a level, and implement schema directive like "@authenticated" or "@hasPerm("perm")" so resolver would do only data resolution, but each approach has advantages and downsides.