How do i protect routes from unauthenticated users?

For example /graphql should only be accessed by logged in user.

PS: Sorry if there were similar questions that’s resolved, please reference me then. Thanks!

[maksimkurb]

You can use middlewares.

Server-side pseudo-code:

app.use('/graphql',
+(req, res, next) => {
+   if (!req.user) { // if user is not logged in
+       res.status(400);
+       res.send('Access denied');
+   } else {
+      next();
+   }
+},
expressGraphQL(req => ({
  schema,
  graphiql: true,
  rootValue: { request: req },
  pretty: process.env.NODE_ENV !== 'production',
})));

but I think it would be better take a look on src/data/queries/me.js:

const me = {
  ...
  resolve({ request }) {
    return request.user && { // return user only if we are logged in
      ... // some result
    };
  },
};

If you need to protect frontend route, you can check out src/routes/admin/index.js:

async action() {
    if (!isAdmin) { // Redirect to login page if user is not admin
      return { redirect: '/login' };
    }

    ...
  },

[maksimkurb]

@tzyhhaur you can think about PassportJS as about abstraction layer of your authentication with pluggable auth strategies for various services. You can install one of them (e.g. facebook, google-oauth, yahoo, paypal) and write your own callback (to register user if it is not registered yet for ex.) which just should return some basic user information (like id and email in /src/core/passport.js), so later you can use it by req.user on your callbacks. There is strategy for firebase, so you can implement it (in /src/core/passport.js and /src/server.js files) like facebook implemented in this boilerplate.