3 ms·
Authorization is usually not handled by a GraphQL framework. You typically have a business layer between your GraphQL API and your database. (And probably some
by codethief 4y ago
Authorization is usually not handled by a GraphQL framework. You typically have a business layer between your GraphQL API and your database. (And probably some basic JWT authentication layer in front of your API. Notice the difference between authorization & authentication.)
- runlaszlorun 4y agoSorry, yes, I meant authorization. So you're saying to just effectively run a filter in the business layer based on allowed role/user/whatever. Seems pretty straightforward but I wonder if I'm missing something.
- codethief 4y ago> run a filter in the business layer based on allowed role/user/whatever Yup, this is the way I've seen it implemented everywhere so far.