Authorization in GraphQL
See original GitHub issueHello,
Is there any way to introduce authorization in GraphQL ?
So i have for example
@GraphQLMutation(name = "createUser")
@ValidationGroups(CreateChecks.class)
public User createUser(@GraphQLArgument(name = "userRequest") @Valid UserRequest userRequest) throws ServiceException
@GraphQLQuery(name = "getUserById")
public User getUserById(@GraphQLArgument(name = "id") @NotNull Integer id) throws ServiceException {
I want only users with a specific role (CREATE_USEr) can execute createUser.
I have the authorzation in the web tier (JAX-RS), but the entry point for all operation in GraphQL is in a single point, so i can’t do:
@RolesAllowed(CREATE_USER)
@POST
@Path("/gql")
public Object graphQL(GQLQuery gqlQuery) throws Exception {
//Executes the graph (invoques the service)
}
because then only user with role CREATE_USER could execute getUserById and that’s not what i want- So is there any way to do that with graphQL ?
Thank you!
Issue Analytics
- State:
- Created 5 years ago
- Comments:5 (2 by maintainers)
Top Results From Across the Web
Authentication and authorization - Apollo GraphQL Docs
Control access to your GraphQL API · Authentication is determining whether a given user is logged in, and subsequently determining which user someone...
Read more >Authorization - GraphQL
Authorization is a type of business logic that describes whether a given user/session/context has permission to perform an action or see a piece...
Read more >Authorization Patterns in GraphQL - Oso
One place to consider building authorization is in the GraphQL resolver layer. GraphQL resolvers are the functions that fetch data for entries ...
Read more >Handling authorization in GraphQL - Pusher
Authorization occurs after a successful authentication, it checks the access levels or privileges of the user, which will determine what the user can...
Read more >Everything you need to know about GraphQL Authentication ...
Authorization entails giving users levels of access to a system. For example, in a bank, the bank manager has access to the bank...
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
Hello again,
Well looking it can be done in guice with Interceptors.
In the AbstractModule in GUICE
bindInterceptor(Matchers.any(), Matchers.annotatedWith(RolesAllowed.class), new AuthorizerInterceptor ());
Then it works!
Hi Kaqqao,
When are you planning to release Authentication and Authorization support.
Thank you!